notif audit should mark stale escalated notifications handled locally

[blink-claw-bot]

Problem

argus notif audit creates escalations for stale pending notifications, but it does not appear to update the notification row after escalating it. That means the same stale notification can stay pending and be escalated again on future audit runs.

Current behavior around cmd_notif_audit:

• Selects dismissed = 0 AND acted_at IS NULL AND seen_at < cutoff
• Inserts an escalation for each stale row
• Leaves the original notification pending

Suggested behavior

After creating an escalation, either:

• mark the notification dismissed/acted with an action like audit-escalated, or
• add an explicit escalated_at / escalation_id field and exclude already-escalated rows from future stale-audit selection.

Implementation hint

Minimal approach:

conn.execute(
    "UPDATE notifications SET dismissed = 1, acted_at = ?, action_taken = ? WHERE id = ?",
    (datetime.now().isoformat(), f"audit-escalated: escalation #{esc_id}", n["id"]),
)

More robust approach:

• Add source_type, source_id, or notification_id to escalations
• Add a unique index for open stale-notification escalations by notification id
• Make audit idempotent: running it twice should not create duplicate open escalations.