[vazra]

Found by the E2E audit.

• The alert rule form dropped the chosen app. The UI sends app_slug; POST/PUT /api/alerts/rules only read app_id. A rule created for one app became an all-apps rule, editing any app rule in the UI made it global, and manage users could not create rules at all. The API now accepts app_slug (resolved and authorized with the same rules as app_id; unknown slugs are 400 for super admins and look like an inaccessible app to others; id/slug mismatch is 400).
• The app Backups tab never updated after "Backup Now": runs published no realtime event, though the realtime docs said global:backups covered runs. The scheduler now publishes backup.run on app:<slug> and global:backups when a backup or restore run starts and finishes (before webhook alerts go out). The Backups tab subscribes and refetches.
• Events about one app carry the app (never sent to clients); the socket delivers them only to users who can view that app, even on global topics, so other users do not learn that an app's backups ran.

Docs: alerts rules guide, API reference, architecture/realtime.md.

Tests: alert rule scope (create/update keep the app, manage user limits, unknown slug, mismatch), Alerts form payload vitest; scheduler publishes start/finish (success, failure, early failure, restore), socket filters app-tagged events per user (fails without the filter), Backups tab refetch vitest.