feat: enhance machine insights and solidify admin workflows

convex/machines.ts

@@ -349,6 +349,20 @@ async function evaluatePostureAndMaybeRaise(
   const lastAtPrev = ensureFiniteNumber(prevMeta?.["lastPostureAt"]) ?? 0
   await ctx.db.patch(machine._id, { metadata: mergeMetadata(machine.metadata, record), updatedAt: now })
 
+  await Promise.all(
+    findings.map((finding) =>
+      ctx.db.insert("machineAlerts", {
+        tenantId: machine.tenantId,
+        machineId: machine._id,
+        companyId: machine.companyId ?? undefined,
+        kind: finding.kind,
+        message: finding.message,
+        severity: finding.severity,
+        createdAt: now,
+      })
+    )
+  )
+
   if ((process.env["MACHINE_ALERTS_CREATE_TICKETS"] ?? "false").toLowerCase() !== "true") return
   if (lastAtPrev && now - lastAtPrev < 30 * 60 * 1000) return
 
@@ -818,6 +832,32 @@ export const listByTenant = query({
   },
 })
 
+export const listAlerts = query({
+  args: {
+    machineId: v.id("machines"),
+    limit: v.optional(v.number()),
+  },
+  handler: async (ctx, args) => {
+    const limit = Math.max(1, Math.min(args.limit ?? 50, 200))
+    const alerts = await ctx.db
+      .query("machineAlerts")
+      .withIndex("by_machine_created", (q) => q.eq("machineId", args.machineId))
+      .order("desc")
+      .take(limit)
+
+    return alerts.map((alert) => ({
+      id: alert._id,
+      machineId: alert.machineId,
+      tenantId: alert.tenantId,
+      companyId: alert.companyId ?? null,
+      kind: alert.kind,
+      message: alert.message,
+      severity: alert.severity,
+      createdAt: alert.createdAt,
+    }))
+  },
+})
+
 export const updatePersona = mutation({
   args: {
     machineId: v.id("machines"),