lazyflat: combined alert + apply behind authenticated web UI

Three isolated services (alert scraper, apply HTTP worker, web UI+DB)
with argon2 auth, signed cookies, CSRF, rate-limited login, kill switch,
apply circuit breaker, audit log, and strict CSP.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

alert/web_client.py

@@ -0,0 +1,39 @@
+import logging
+import requests
+
+from settings import WEB_URL, INTERNAL_API_KEY
+
+logger = logging.getLogger("alert")
+
+
+class WebClient:
+    def __init__(self, base_url: str = WEB_URL):
+        self.base_url = base_url.rstrip("/")
+        self.headers = {"X-Internal-Api-Key": INTERNAL_API_KEY}
+
+    def submit_flat(self, flat_payload: dict) -> bool:
+        try:
+            r = requests.post(
+                f"{self.base_url}/internal/flats",
+                json=flat_payload,
+                headers=self.headers,
+                timeout=10,
+            )
+            if r.status_code >= 400:
+                logger.error(f"web rejected flat: {r.status_code} {r.text[:300]}")
+                return False
+            return True
+        except requests.RequestException as e:
+            logger.error(f"web unreachable: {e}")
+            return False
+
+    def heartbeat(self) -> None:
+        try:
+            requests.post(
+                f"{self.base_url}/internal/heartbeat",
+                json={"service": "alert"},
+                headers=self.headers,
+                timeout=5,
+            )
+        except requests.RequestException:
+            pass