Addresses alert fatigue from the same alert firing every collection cycle. Adds two complementary levers:

Per-alert snooze — silence a specific instance for 4h, 24h, or 7d. Compositional with the existing per-policy SuppressionMinutes, which still blocks new alerts for a policy.

Silent auto-resolve — when an open alert's underlying metric has been below its threshold for AutoResolveDebounceCycles consecutive evaluation cycles, the alert transitions to auto_resolved. No notification is dispatched; no NotificationLog entry is written. Manual resolve still wins (first transition wins, terminal states cannot re-open).

Changes

• src/M365SecurityDashboard.Api/Data/AlertingSchema.cs — four new IF COL_LENGTH ALTER blocks add SnoozedUntil, SnoozedBy, BelowThresholdStreakCount (NOT NULL DEFAULT 0), LastEvaluatedAt to TriggeredAlerts. Mirrors the existing SourceFailureDetails pattern, so installs created before this PR get the new columns at startup without a migration.
• src/M365SecurityDashboard.Api/Models/TriggeredAlert.cs — four new properties matching the schema.
• src/M365SecurityDashboard.Api/Models/AlertingOptions.cs (new) — AutoResolveDebounceCycles (default 2).
• src/M365SecurityDashboard.Api/Services/AlertEvaluator.cs — auto-resolve loop appended after the dispatch block; injects IOptions<AlertingOptions>. Silent (no dispatch call, no log row).
• src/M365SecurityDashboard.Api/Program.cs — two new endpoints (POST /api/triggered-alerts/{id}/snooze, POST .../unsnooze); SnoozeRequest DTO at the bottom; AlertingOptions binding alongside the existing GraphOptions binding.
• src/M365SecurityDashboard.Api/appsettings.json — new Alerting:AutoResolveDebounceCycles section.
• src/m365-security-dashboard-client/src/main.tsx — TriggeredAlert interface gains the four new fields; acApi gains snooze / unsnooze; statusTone maps the new statuses (snoozed → neutral, auto_resolved → info); status filter dropdown adds two options; action cell gains a snooze <select> with 4h/24h/7d presets and an Unsnooze button; detail modal surfaces Snoozed until and Last evaluated; the active-alerts table and mini-list both render a muted "snoozed until" indicator.
• src/M365SecurityDashboard.Api.Tests/ (new project) — 7 xUnit tests for the auto-resolve path. Uses Microsoft.EntityFrameworkCore.InMemory for the test AppDbContext. NotificationSender is constructed but never invoked by the loop under test, so no HTTP/DPAPI dependencies are exercised.

Testing

dotnet test M365SecurityAlertDashboard.sln
Passed!  - Failed: 0, Passed: 7, Skipped: 0, Total: 7

Coverage of the new auto-resolve logic:

• streak increments on a below-threshold observation
• auto-resolve after AutoResolveDebounceCycles consecutive observations
• streak resets to zero on any above-threshold observation
• debounce-of-one auto-resolves on the first observation
• terminal-state alerts (resolved, auto_resolved) are skipped
• no notification dispatch on auto-resolve (verified by an empty NotificationLogs table after transition)
• AcknowledgedAt and AcknowledgedBy survive an auto-resolve transition

Deferred (not in this PR)

• Maintenance windows / quiet hours
• Per-policy snooze shortcut
• "Snooze all" bulk action
• Auto-resolve notification ("send resolved" mode)
• Per-entity alerting (the biggest leverage move for noise reduction long-term, but a bigger refactor)
• Real user identity for SnoozedBy (placeholder literal matches the existing AcknowledgedBy = "dashboard" pattern; auth lands separately)

Verification before merging

npm run build in src/m365-security-dashboard-client/ is clean. dotnet build is clean (0 warnings, 0 errors). Schema migration smoke test: start the API against an existing DB with pre-feature TriggeredAlerts rows; the four IF COL_LENGTH blocks run without error and existing rows render with the new fields as NULL or 0. Manual smoke for the snooze/unsnooze endpoints is in the plan notes.