Update a semantic alert

Signed-in semantic alerts (#2304). Stores a freeform interest and email/webhook preferences. Matching runs after release.created for releases already on the caller's follow graph: one JEV decision per release, one question per enabled alert, notify when the matches-interest probability is at least the alert threshold (default 0.80, allowed 0.50–1.00). At most 5 alerts per account. Query text is user-private and is never written to Analytics Engine. Requires a Better Auth session or a user Bearer token (relu_ or OAuth JWT); machine relk_ tokens and anonymous callers are refused. Returns 404 when semantic-alerts-enabled is off. Partial body. webhookSubscriptionId: null clears the link. An empty body returns the current alert.