Add Sandbar alert channel, tags for resources and sites, use Reef's secretbox

Sandbar channels raise and resolve alerts through its API, with the API key
sealed at rest and never returned to the browser. Resources and sites can be
tagged and filtered by tag; sites can be renamed. The secretbox package now
comes from Reef v0.1.9 instead of a private copy.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

mappings.go

@@ -53,9 +53,39 @@ func listFromCSV(in []string) []string {
 	return out
 }
 
+// normalizeTags trims tags, drops blanks and repeats (ignoring case; the first spelling wins)
+// and keeps the list short enough to stay readable in the dashboard.
+func normalizeTags(in []string) ([]string, error) {
+	var out []string
+	seen := map[string]bool{}
+	for _, t := range in {
+		t = strings.Join(strings.Fields(t), " ")
+		if t == "" || seen[strings.ToLower(t)] {
+			continue
+		}
+		if len([]rune(t)) > 32 {
+			return nil, errors.New("A tag can be at most 32 characters.")
+		}
+		if strings.ContainsAny(t, ",<>\"") {
+			return nil, errors.New("Tags can't contain commas, quotes or angle brackets.")
+		}
+		seen[strings.ToLower(t)] = true
+		out = append(out, t)
+	}
+	if len(out) > 10 {
+		return nil, errors.New("Use at most 10 tags.")
+	}
+	return out, nil
+}
+
 // validateMapping checks m against org c and normalises it. Caller holds s.mu.
 func (s *Server) validateMapping(c *orgCtx, m *model.Mapping) error {
 	m.Name = strings.TrimSpace(m.Name)
+	tags, err := normalizeTags(m.Tags)
+	if err != nil {
+		return err
+	}
+	m.Tags = tags
 	m.Hostname = strings.ToLower(strings.TrimSpace(m.Hostname))
 	m.OrgID = c.Org.ID
 	switch m.Proto {