Baler Fault API

CRUD for fault-detection rules and webhook subscriptions, plus a read endpoint over detected faults. This is a separate process/port from the ingest API (ingest_api.py, openapi.yaml) - each API's spec is served by the process it actually describes, so this document is never a stale claim about a process that doesn't own it.

The actual detection work (evaluating rules against live readings and historical data, firing webhooks) happens in a third process, fault_detector.py, which reads the same rules.json/webhooks.json files this API writes - there's no direct connection between this API and the detector beyond that shared config.