Alarm webhook

Runtime optionally POSTs HTTP on alarm ACTIVE or CLEAR transitions.

Env	Meaning
VION_ALARM_WEBHOOK_URL	http/https target; empty = off
VION_ALARM_WEBHOOK_TOKEN	Authorization: Bearer …

Ack / shelve do not trigger the webhook. No email/SMS.