Add Sandbar alert channel, tags for resources and sites, use Reef's secretbox

Sandbar channels raise and resolve alerts through its API, with the API key
sealed at rest and never returned to the browser. Resources and sites can be
tagged and filtered by tag; sites can be renamed. The secretbox package now
comes from Reef v0.1.9 instead of a private copy.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

go.mod

@@ -5,7 +5,7 @@ go 1.27.3
 require (
 	git.veillax.com/Veillax/bamboo v0.1.5
 	git.veillax.com/Veillax/blacktip v0.1.8
-	git.veillax.com/Veillax/reef v0.1.7
+	git.veillax.com/Veillax/reef v0.1.9
 	github.com/emersion/go-msgauth v0.7.0
 	golang.org/x/crypto v0.58.0
 	modernc.org/sqlite v1.61.0