Alerts: configuration, test and search entries are a superuser's; subscribing a browser stays open

Any signed-in account could save an ntfy channel with its own `server` and a
`{"$secret": ...}` token and press Test, which sent the stored secret to that
host. The config GET/PUT, the test route and the global search's alert entries
now answer to superusers, like /secrets. The webpush key and subscribe routes
stay open to every account, and the Alerts page shows a non-superuser only the
button for its own browser. The events table in the docs gains run_finished.

docs/code/api.md

@@ -220,8 +220,11 @@ reclaiming space sooner.
 | `POST` | `/modules/apply` | replace the manifest with `{"requirements": "numpy>=2\n"}` |
 | `GET`, `PUT` | `/alerts/config` | read or update alert configuration |
 | `POST` | `/alerts/test/{channel}` | test a channel |
+| `GET` | `/alerts/webpush/key` | the key a browser subscribes against; any account |
+| `POST` | `/alerts/webpush/subscriptions`, `/alerts/webpush/unsubscribe` | add or remove the calling browser; any account |
 
-Secrets and package changes require a superuser. Applying a manifest replaces
+Secrets, package changes and the alert configuration require a superuser. Any
+account can subscribe its own browser. Applying a manifest replaces
 the whole managed environment's package list. Adopted environments are read-only
 here; install their packages yourself.