[Feature] 飞书告警通知升级为交互式卡片与中文汉化

[Zara1024]

需求背景 (Background)

目前系统的告警通知流水线在向飞书 Webhook 机器人发送告警时，使用的是无样式的纯英文普通文本（msg_type: "text"）：

[CRITICAL] device_offline: device_last_seen_seconds_ago > 90 ⇒ device_id=1,device_name=阿里云ECS01,instance=ongrid:9100,job=ongrid-manager (value=51229.302550603)
source: global
dedupe: pipeline:device_offline:device_id=1,device_name=阿里云ECS01,instance=ongrid:9100,job=ongrid-manager

在日常运维实践中存在以下体验痛点：

1. 视觉层级弱：纯文本展示难以让值班运维人员快速识别告警级别（严重 P1、预警 P2、恢复）；
2. 缺乏汉化与友好展示：规则名称『设备对象『告警状态等关键信息以内部原始标识符呈现，排版杂乱；
3. 时区偏差（少 8 个小时）：Linux/Docker 容器内部时间默认为 UTC，导致飞书展示的发生时间比北京时间（CST，UTC+8）慢整整 8 个小时，极易引起运维误判；
4. 缺少快捷操作入口：通知中无法直接点击跳转到相关受影响设备或告警详情页。

预期效果与改进建议 (Proposed Solution)

1. 升级为飞书交互式消息卡片（Card 2.0，msg_type: "interactive"）；
2. 级别与状态多色联动：
   • 🔴 严重告警（Critical）：顶栏红色（red），前缀 🚨【严重告警】；
   • 🟠 预警提示（Warning）：顶栏橙色（orange），前缀 ⚠️【预警提示】；
   • 🔵 提醒通知（Info）：顶栏蓝色（blue），前缀 ℹ️【通知提醒】；
   • 🟢 告警恢复（Resolved）：顶栏绿色（green），前缀 ✅【告警恢复】；
   • 🟡 告警认领（Acknowledged）：顶栏黄色（yellow），前缀 🟡【告警认领】。
3. 结构化双列网格排版：清晰展示【告警级别】、【告警状态】、【告警对象】、【规则名称】与【发生时间】；
4. 北京时间（CST / UTC+8）自动对齐：使用 time.FixedZone("CST", 8*3600) 兜底转换，消除容器默认 UTC 导致的 8 小时时间偏差；
5. 快捷操作按钮：根据上下文提供的控制台地址生成「🔍 查看设备详情」与「📋 告警中心」跳转按钮；
6. 安全兼容：完整保留时间戳与 HMAC-SHA256 签名机制，对钉钉、企业微信、Slack 等其他渠道保持 100% 隔离无影响。

效果预览 (Preview)

[singchia]

Review update for the implementation in PR #441: the card-formatting improvement is welcome, but the review currently requests changes before merging.

Required fixes:

1. Use structured incident state rather than subject substrings to determine recovery. An open critical incident containing unresolved or systemd-resolved in its subject can currently be rendered as a green recovery card.
2. Wire the configured public console URL into the production notification pipeline. The tests supply console_url manually, but production notifications do not populate it, so the navigation buttons are missing. Link to the specific incident where supported.
3. Handle the actual active incident status, open, rather than only firing, including localization and regression coverage.

Additional gospec/design feedback: split the oversized card formatter into focused helpers, apply gofmt, keep retry metadata consistent with first-send notifications, retain a visible incident ID, and add tests using real pipeline metadata and timezone/error boundaries.

Verification: existing notification and alert tests passed with race detection. Additional review-only tests reproduced the incorrect recovery classification and missing incident identity. Real Feishu webhook delivery was not independently verified.

The detailed review is in #441. Keeping this issue open and unresolved until the required fixes are addressed and verified.