Alerts: configuration, test and search entries are a superuser's; subscribing a browser stays open

Any signed-in account could save an ntfy channel with its own `server` and a
`{"$secret": ...}` token and press Test, which sent the stored secret to that
host. The config GET/PUT, the test route and the global search's alert entries
now answer to superusers, like /secrets. The webpush key and subscribe routes
stay open to every account, and the Alerts page shows a non-superuser only the
button for its own browser. The events table in the docs gains run_finished.

docs/interface/operations.md

@@ -50,7 +50,9 @@ with `fluksio-worker --python /path/to/venv/bin/python`. See
 ## Alerts
 
 Create a channel, choose events in a rule, and use **Test** to check delivery.
-Enable alerts for the rules to send.
+Enable alerts for the rules to send. Channels and rules belong to superusers,
+whose Alerts page holds them. Any other account sees only the button that
+subscribes its own browser to a **webpush** channel.
 
 ### Channels
 
@@ -79,6 +81,7 @@ matches every supported alert event, including future additions.
 | `engine_degraded` | engine health degrades |
 | `cascade_dropped` | the engine drops work |
 | `queue_unavailable` | the work queue becomes unreachable |
+| `run_finished` | a batch run ends in error |
 
 Repeated faults are deduplicated with a 15-minute default cooldown.
 Flapping connections are suppressed, and the engine caps alert dispatches at