feat(alerts): event-driven pipeline with delivery guarantees

[demilade18-git]

Summary

Closes #12 — Align growth/alerts Module: Event-Driven Alert Pipeline with Delivery Guarantees.

• AlertPreference entity (alert_preferences table) with channels, quietHoursStart, quietHoursEnd, and rateLimit columns
• AlertDispatcherService with in-memory fingerprint deduplication (5-minute window), per-user rate limiting (default 10/hour), quiet-hours suppression, and exponential backoff retry (up to 3 attempts, base 200 ms)
• RiskAlertListener subscribing to risk.threshold.breached events via @OnEvent
• PortfolioAlertListener subscribing to portfolio.rebalanced events via @OnEvent
• Dual-channel delivery: in-app (persisted to AlertTriggerLog) + email (logged, ready for SendGrid/SES integration)
• Subscribe/Unsubscribe endpoints with full Swagger @ApiOperation and @ApiResponse documentation behind JwtAuthGuard
• EventEmitterModule.forRoot() registered in AlertsModule
• AlertPreference registered in global TypeORM entities list in app.module.ts
• 8 unit tests in alert-dispatcher.service.spec.ts covering all acceptance criteria

Acceptance Criteria Met

• RiskAlertListener creates alerts when risk.threshold.breached events are emitted
• AlertDispatcher delivers through at least 2 channels (in-app + email)
• Duplicate alerts within a 5-minute window are deduplicated
• Failed deliveries retry up to 3 times with exponential backoff (200ms, 400ms)
• AlertPreference entity with channel and quiet-hours configuration
• POST /api/alerts/subscribe and DELETE /api/alerts/unsubscribe/:userId documented in Swagger
• Rate limiting prevents more than 10 alerts per user per hour (configurable)
• npm run build succeeds

Test Plan

• npx jest --testPathPattern="alert-dispatcher" --no-coverage — 8 tests pass
• Verify POST /api/alerts/subscribe with { userId, channels: ["in-app","email"] } returns 201
• Verify DELETE /api/alerts/unsubscribe/:userId removes preference
• Emit risk.threshold.breached event and confirm AlertTriggerLog entry is created
• Send 11 alerts for same user in 1 hour — confirm 11th is rate-limited
• Send same alert payload twice within 5 minutes — confirm second is deduplicated