[UIAM API key] Adds docs for Elastic Cloud API keys and rules

[nastasha-solomon]

Summary

Addresses #702 by adding a new reference page for Elastic Cloud API keys and rules, and propagating a Serverless-scoped note across all relevant rule creation and management pages.

Also created a new reusable snippet at solutions/_snippets/elastic-cloud-api-key-rules.md. The snipped it a Serverless-scoped note that explains new and edited rules automatically use Elastic Cloud API keys, and links to the new reference page. It's been included in the following pages:

Stack alerting docs

• Elasticsearch query rule
• Index threshold rule
• Transform health rules

Observability alerting docs

• Create and manage Observability rules
• Create a degraded docs rule
• Create a failed docs rule
• Create an anomaly detection rule
• Create an APM anomaly rule
• Create an Elasticsearch query rule
• Create an error count threshold rule
• Create an inventory rule
• Create an SLO burn rate rule
• Create an uptime duration anomaly rule
• Create a custom threshold rule
• Create a failed transaction rate threshold rule
• Create a latency threshold rule
• Create a log threshold rule
• Create a metric threshold rule
• Create a monitor status rule
• Create a TLS certificate rule

Secrurity alerting docs

• Create a detection rule using the UI

Review request

• Rules and API keys in Serverless: New page that explains how Elastic Cloud API keys affect rule behavior, ownership, and scope in Serverless projects. Covers the differences from Elasticsearch API keys, what does not update automatically after migration (new roles, role changes, orphaned rules), a post-migration checklist organized into three collapsed dropdowns (right after migration, within 90 days, ongoing), and a table summarizing how rule behavior improves after migration.
• Observability alerting overview | Authentication: Adds a new "Authentication" section explaining that rules use an API key for all background tasks.
• Alerting setup | Elasticsearch API keys: Updates the section intro to show the different key types used by deployments.
• Detection rule concepts | API key: Updates the API key glossary definition and Rule authorization glossary term to distinguish both key types, with links to each.
• Detections privileges: Updates the authorization model bullet and the important callout to name both API key types and clarify which applies in each deployment.
• Manage detection rules: Updates the API key reference in the important callout to {{es}} API key with a link to the Elasticsearch API keys page.

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[github-actions]

🔍 Preview links for changed docs

• deploy-manage/api-keys/rules-and-elastic-cloud-api-keys.md
• explore-analyze/alerting/alerts/alerting-setup.md
• explore-analyze/alerting/alerts/geo-alerting.md
• explore-analyze/alerting/alerts/rule-type-es-query.md
• explore-analyze/alerting/alerts/rule-type-index-threshold.md
• explore-analyze/transforms/transform-alerts.md
• solutions/observability/incident-management/alerting.md
• solutions/observability/incident-management/create-a-degraded-docs-rule.md
• solutions/observability/incident-management/create-a-failed-docs-rule.md
• solutions/observability/incident-management/create-an-anomaly-detection-rule.md

More links …

• solutions/observability/incident-management/create-an-apm-anomaly-rule.md
• solutions/observability/incident-management/create-an-elasticsearch-query-rule.md
• solutions/observability/incident-management/create-an-error-count-threshold-rule.md
• solutions/observability/incident-management/create-an-inventory-rule.md
• solutions/observability/incident-management/create-an-slo-burn-rate-rule.md
• solutions/observability/incident-management/create-an-uptime-duration-anomaly-rule.md
• solutions/observability/incident-management/create-custom-threshold-rule.md
• solutions/observability/incident-management/create-failed-transaction-rate-threshold-rule.md
• solutions/observability/incident-management/create-latency-threshold-rule.md
• solutions/observability/incident-management/create-log-threshold-rule.md
• solutions/observability/incident-management/create-manage-rules.md
• solutions/observability/incident-management/create-metric-threshold-rule.md
• solutions/observability/incident-management/create-monitor-status-rule.md
• solutions/observability/incident-management/create-tls-certificate-rule.md
• solutions/security/detect-and-alert/detection-rule-concepts.md
• solutions/security/detect-and-alert/detections-privileges.md
• solutions/security/detect-and-alert/manage-detection-rules.md
• solutions/security/detect-and-alert/using-the-api.md
• solutions/security/detect-and-alert/using-the-rule-ui.md

[github-actions]

Vale Linting Results

Summary: 2 warnings, 5 suggestions found

⚠️ Warnings (2)

File	Line	Rule	Message
solutions/observability/incident-management/create-latency-threshold-rule.md	17	Elastic.DontUse	Don't use 'and/or'.
solutions/observability/incident-management/create-latency-threshold-rule.md	17	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.

💡 Suggestions (5)

File	Line	Rule	Message
explore-analyze/alerting/alerts/alerting-setup.md	100	Elastic.WordChoice	Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
solutions/observability/incident-management/create-an-inventory-rule.md	49	Elastic.Semicolons	Use semicolons judiciously.
solutions/security/detect-and-alert/detection-rule-concepts.md	95	Elastic.WordChoice	Consider using 'run, start' instead of 'Execute', unless the term is in the UI.
solutions/security/detect-and-alert/detection-rule-concepts.md	97	Elastic.WordChoice	Consider using 'run, start' instead of 'Execute', unless the term is in the UI.
solutions/security/detect-and-alert/detection-rule-concepts.md	123	Elastic.WordChoice	Consider using 'run, start' instead of 'execute', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.