Focus on a site or a camera, or hold a site

From now on every NEW alarm in scope that enters the operator queue while nobody holds it is reserved for the caller until they release (or the Keep / Release check runs out). It never takes alarms already waiting; anyone can Take over a reserved alarm. Body {site_id, scope: {kind: site} | {kind: camera, camera_id}}. 201 for a new focus, 200 (the existing record) when the caller already has this exact one. 409 focus_exists (the caller has a focus with another scope; focus is it), 409 focus_conflict (another operator's focus overlaps; focus names them), 409 focus_draining (a previous generation is still being cleaned up: retry), 409 CONFLICT (retired site), 403 (not central staff, an owner, no review_label_alarms, or the site is out of scope), 404 (unknown site, or a camera not at the site). 404 while FOCUS_ENABLED is off. With origin: "story" (site scope only) this starts a SITE HOLD: the caller owns the site while its story is open, every alarm there (waiting ones included, with no age limit) is reserved for them, the page keeps it with POST /focus/{id}/heartbeat. 201 / 200 as above; 409 focus_conflict names whoever already holds or focuses the site (an operator may hold several sites); 404 while SITE_HOLD_ENABLED is off.