List Alerts

List all alerts for a user.

See the matching comment on list_trips — user_id query param is optional and falls back to the JWT sub so mobile clients don't have to echo their own UUID on every call.

A brand-new user that's never set a fare alert should see the empty-state on mobile, not a 500. We therefore fail-open on any DB / cache hiccup below: log it and return {"alerts": []}. The Trips screen already does the same, and mobile's getAlerts has no retry path so a 500 here = the whole Deals tab reads as broken.