Mark a queued alarm as being worked (soft claim)

Called when an operator opens an alarm's review panel. The first operator to open it holds the claim for two minutes or until the alarm is triaged, whichever is shorter; other consoles show an "Operator working" badge on it and grey it out for other operators and monitoring managers (owners see the badge but are not greyed out). Reopening does not extend a claim. Monitoring managers take claims like operators; owners never do. Customer-side callers neither take claims nor receive claimant identity. Always 200 with the live claim for central staff, whoever holds it, or null; opening never blocks anyone (with CLAIM_REFUSAL_ENABLED on, what a claim does is refuse ANOTHER operator's close and outbound actions, see POST /events/{id}/claim/take-over). With claim cleanup enabled, alarms outside the active queue return null and are not claimed. This event-level acquire endpoint is separate from the renew-only endpoint POST /events/{id}/claim/renew; the whole-site claim (POST /sites/{id}/claim) is retired by default (SITE_CLAIM_ENABLED). Requires review_label_alarms and tenant scope (out of scope is 403, unknown is 404). Unlike renew, take-over and the two claim reads, acquire is NOT widened to the outbound-action permissions: it is the review-panel open, and a refused operator without review_label_alarms becomes the holder through take-over.