feat: alert API connectors with scheduled daily imports

CLAUDE.md

@@ -102,6 +102,8 @@ Writes `manifest.jsonl` (one line per alert) plus `images/{source_api}/{platform
 
 **Backend data flow**: Alert API → ingestion scripts → annotation_api DB → frontend UI → human annotations
 
+**Ingestion**: Daily ingestion is connector-driven (worker sweep at 03:00 UTC, configured at `/connectors`); the CLI import script is retained for backfilling arbitrary date ranges.
+
 **Processing stages** (sequence): `IMPORTED` → `READY_TO_ANNOTATE` → `SEQ_ANNOTATION_DONE` → `ANNOTATED`. Two-lane exit: FP-only lanes jump straight to `ANNOTATED` at classify submit; smoke lanes park at `SEQ_ANNOTATION_DONE`, get auto-annotated per alert once every sibling (shared `platform_alert_id`) is classified, and reach `ANNOTATED` via the Smoke Localization submit (see `docs/specs/2026-07-28-smoke-localization-entry-point-design.md`).
 
 **Backend patterns**: CRUD modules per entity, Pydantic schemas separate from SQLModel, dependency injection, fastapi-pagination, IoU-based annotation generation service.

annotation_api/.env.example

@@ -41,3 +41,9 @@ ALERT_API_LOGIN=your_alert_api_username
 ALERT_API_PASSWORD=your_alert_api_password
 ALERT_API_ADMIN_LOGIN=your_admin_username
 ALERT_API_ADMIN_PASSWORD=your_admin_password
+
+# Fernet key encrypting alert-API connector passwords at rest.
+# Generate: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+CONNECTOR_SECRET_KEY=
+# Where the worker reaches the annotation API (compose service name).
+ANNOTATION_API_INTERNAL_URL=http://annotation_api:5050

annotation_api/CLAUDE.md

@@ -453,6 +453,38 @@ uv run python -m scripts.data_transfer.ingestion.alert_api.import \
 - **Logging support** - Configurable log levels for debugging
 - **Stage management** - Automatic transitions from alert API data to READY_TO_ANNOTATE stage
 
+### Alert API Connectors
+
+Ongoing daily ingestion runs through connectors instead of the CLI. A connector is
+one alert API credential (base URL, login, password) plus the set of remote
+organizations it should import from.
+
+- **Configuration**: Connectors are managed in the frontend at `/connectors`,
+  superuser only. Creating one stores the credential, discovers the alert API's
+  organizations, and lets the superuser enable individual organizations for import.
+- **Schedule**: The worker sweeps all enabled connectors daily at 03:00 UTC
+  (`schedule_connector_imports` in `src/app/worker.py`) and imports each one's
+  trailing window (`run_connector_import`). `trailing_days` (default 3, configurable
+  per connector) is both the re-check window and the catch-up mechanism — a worker
+  that missed a run recovers the lost date inside the next run's window, so no
+  "already ran today" bookkeeping is needed.
+- **`CONNECTOR_SECRET_KEY`**: Required for connectors to work. Alert-API passwords
+  can't be hashed (the worker needs the plaintext to log in), so they're Fernet-
+  encrypted at rest with this key. Generate one with:
+  ```bash
+  python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+  ```
+  If unset, connector create/update returns `400` and the worker skips connector
+  imports — existing deployments that never set it keep working untouched. Losing
+  the key means re-entering credentials through the UI.
+- **Backfill**: The UI has no backfill and enabling a new organization does not
+  retroactively import its history. `make import-alert-api DATE_FROM=… DATE_END=…`
+  remains the way to import an arbitrary date range by hand.
+- **Coverage**: Each (connector, organization, day) import attempt is recorded as a
+  coverage row, rendered as a heatmap on the connector detail page. A day with zero
+  alerts is recorded as `ok` with zero counts — deliberately distinct from a day
+  that was never attempted, so a dashed cell always means "we never got there."
+
 ## Troubleshooting
 
 ### Common Issues

annotation_api/Dockerfile

@@ -35,6 +35,8 @@ RUN --mount=type=cache,target=/root/.cache/uv \
 COPY src/alembic.ini /app/alembic.ini
 COPY src/migrations /app/migrations
 COPY src/app /app/app
+# The worker imports the alert-API importer as a library (see app/worker.py).
+COPY scripts /app/scripts
 
 # Install project
 RUN --mount=type=cache,target=/root/.cache/uv \

annotation_api/pyproject.toml

@@ -41,6 +41,9 @@ dependencies = [
     "pillow>=10.0.0",
     "procrastinate>=2.0.0,<4.0.0",
     "psycopg[binary]>=3.1.0",
+    "cryptography>=42.0.0",
+    "pyyaml>=6.0",
+    "python-dotenv>=1.0.0",
 ]
 
 [dependency-groups]
@@ -59,7 +62,6 @@ dev = [
     "requests-mock>=1.11.0",
     "httpx>=0.23.0",
     "aiosqlite>=0.16.0,<1.0.0",
-    "pyyaml>=6.0",
 ]
 
 [tool.coverage.run]

annotation_api/scripts/data_transfer/ingestion/alert_api/client.py

@@ -63,7 +63,13 @@ def api_get(route: str, access_token: str):
     """
     headers = make_request_headers(access_token=access_token)
     logging.debug(f"Making an HTTP request to route {route}")
-    response = requests.get(route, headers=headers)
+    # 30s: these are list endpoints (sequences/cameras/organizations) that can
+    # legitimately take longer than the 5s token exchange under real load, but
+    # this now also runs on the worker's connector-verify path behind a button
+    # a human is watching (via asyncio.to_thread), so it must never hang
+    # forever on a black-holed connection — no timeout previously bounded this
+    # call at all.
+    response = requests.get(route, headers=headers, timeout=30)
     try:
         return response.json()
     except Exception: