refactor(monitor): encapsulate engine state, add graceful shutdown and tests

Replace all monitor package-level mutable state with Engine struct.
All state (liveState, logStore, histories, tokenIndex, HTTP clients)
is now encapsulated in Engine, created via NewEngine(store).

Key changes:
- Engine struct holds all monitor state with proper mutex protection
- Engine.Start(ctx) and monitorRoutine respect context cancellation
  for graceful shutdown — no more leaked goroutines
- cluster.runFollowerLoop also respects context for clean exit
- Token index (map[string]int) for O(1) push heartbeat lookup,
  replacing O(n) linear scan through LiveState
- UpdateSiteConfig preserves 8 runtime fields instead of copying
  17 config fields individually
- triggerAlert goroutines get 30s timeout context
- All consumers (TUI, server, cluster, main) receive *Engine via
  constructor/parameter — no package-level state access
- main.go creates context.WithCancel, passes to engine and cluster

First test suite: 12 tests across store and alert packages
- Store: CRUD for sites/alerts/users, push token generation,
  import/export round-trip, check history persistence
- Alert: Discord/Slack/Webhook payload format, HTTP 4xx error
  propagation, Ntfy headers, unknown provider returns nil

internal/tui/tab_users.go

@@ -2,7 +2,6 @@ package tui
 
 import (
 	"fmt"
-	"go-upkeep/internal/monitor"
 
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/huh"
@@ -104,11 +103,11 @@ func (m *Model) submitUserForm() {
 	d := m.userFormData
 	if m.editID > 0 {
 		if err := m.store.UpdateUser(m.editID, d.Username, d.PublicKey, d.Role); err != nil {
-			monitor.AddLog("Update user failed: " + err.Error())
+			m.engine.AddLog("Update user failed: " + err.Error())
 		}
 	} else {
 		if err := m.store.AddUser(d.Username, d.PublicKey, d.Role); err != nil {
-			monitor.AddLog("Add user failed: " + err.Error())
+			m.engine.AddLog("Add user failed: " + err.Error())
 		}
 	}
 	m.state = stateUsers