Separate delivery receipts from dismissals

The client acks a frame as soon as it arrives — that is how an online device
stops being re-told — and the service recorded that ack in acked_at, the
column the drain-to-empty rule counts. Measured on an Android 15 emulator:
the owner's trigger reached the subscriber at .562 and the alert was
destroyed 27 ms later, mid-siren, so the owner's disarm answered
ERR_ALERT_NOT_FOUND.

alarm_deliveries now carries two timestamps. delivered_at is the receipt
(the WS ack frame and the offline check-in): it retires re-delivery and
nothing else. acked_at is the human dismissal (ackAlarm): only that ends the
alert, once every subscription's row is dismissed. Migration 011 adds the
column and replaces the pending index with an undelivered one.

ackAlarm also runs the drain check on every explicit dismissal, not only when
this call cleared a row: a receipted row still has to be dismissed.

Also fixed, found by the same probe run: db.Close left the closed pool as the
process singleton (a second probe inherited it), and the lifecycle probe's
three subscriptions shared one device id, which migration 010 made illegal.

Verified: both probes pass against the live dev database, including the new
receipt-vs-dismissal case; migration 011 applied to the dev DB.

src/actions/ack.go

@@ -125,13 +125,17 @@ func AckAlarm(w http.ResponseWriter, r *http.Request, payload any) {
 				dbError(w, action, err)
 				return
 			}
-			destroyed, err := db.CompleteAlertDeliveries(r.Context(), alertID)
-			if err != nil {
-				dbError(w, action, err)
-				return
-			}
-			resp.Destroyed = destroyed
 		}
+		// The drain check runs on every explicit dismissal, not only when this
+		// call cleared a row: the receipt ack marks a row delivered but not
+		// dismissed, so the person dismissing is what completes the set even
+		// when there was nothing left for THIS call to clear.
+		destroyed, err := db.CompleteAlertDeliveries(r.Context(), alertID)
+		if err != nil {
+			dbError(w, action, err)
+			return
+		}
+		resp.Destroyed = destroyed
 		Debug(action, "POST", "alert=%s event=%s all=%t acked=%d destroyed=%t (device)",
 			alertID, resp.EventID, eventID == uuid.Nil, resp.Acked, resp.Destroyed)
 		writeJSON(w, http.StatusOK, resp)
@@ -163,13 +167,13 @@ func AckAlarm(w http.ResponseWriter, r *http.Request, payload any) {
 				dbError(w, action, err)
 				return
 			}
-			destroyed, err := db.CompleteAlertDeliveries(r.Context(), alertID)
-			if err != nil {
-				dbError(w, action, err)
-				return
-			}
-			resp.Destroyed = destroyed
 		}
+		destroyed, err := db.CompleteAlertDeliveries(r.Context(), alertID)
+		if err != nil {
+			dbError(w, action, err)
+			return
+		}
+		resp.Destroyed = destroyed
 	}
 
 	Debug(action, "POST", "alert=%s event=%s all=%t acked=%d destroyed=%t",