Merge branch 'feature/sandbar-integration'

# Conflicts:
#	store.go

README.md

@@ -208,6 +208,18 @@ headers, Host rewrite, HTTPS to the backend, certificate status per port.
   it, so restarts and blips stay quiet. One message when it starts, one when it clears, optional
   reminders. Active alerts are stored, so restarting Hammerhead doesn't repeat them, and an alert is
   only marked resolved once the thing it describes has been re-checked.
+- **Sandbar** ([self-hosted notifications, monitors and on-call](https://git.veillax.com/Veillax/sandbar)) can
+  receive alerts in two ways. A *Sandbar* channel raises the alert through its API (and resolves it when the
+  problem clears), so the escalation policy you name pages whoever is on call. A *Sandbar topic* channel
+  publishes a plain message to a topic, which anyone subscribed (the web page, `curl`, the ntfy phone app) sees;
+  the API key is optional there, for servers that don't ask for one. Keys are sealed at rest and never sent back
+  to the browser.
+- **Sandbar monitors** (Server, Settings): turn this on with Sandbar's address and an administrator's API key,
+  and Hammerhead creates a Sandbar monitor for every enabled resource that has health checks: a website is
+  fetched at its public address (a sign-in page counts as up), a TCP port is connected to on the edge's public
+  IP. Each gets uptime history, an optional place on the status page, and the escalation policy you pick.
+  Redirects, UDP, wildcard hostnames and resources with health checks off get none. Hammerhead re-syncs every
+  minute, renames and removes the monitors it created, and never touches ones you made in Sandbar by hand.
 - A dead edge silences its own ports' alerts (the edge alert already says it). Channels are per
   organization; **server channels** get edge alerts.
 - Webhooks can't be pointed at internal addresses (no metadata service, no LAN) unless a server admin