feat(service-credential-tester): slice 1 — backend test endpoint + per-type routines

TestResult dataclass + translate_connection_error shared helper in base.py.
test_callable field on ServiceDefinition (default None). 7 per-type
test_connection routines (qbittorrent, prometheus via Grafana gateway,
alertmanager, jellyfin, authentik, ssh_tasks via build_ssh_client, nextcloud).
POST /api/services/test endpoint: validation-first (422 on malformed config),
dispatch, no-persistence, no-secret-logs. backups has test_callable=None.
qBit 'Fails.' → specific auth message (resolves #3 at API layer).
Backend: 362 pytest pass (+31 new), ruff clean. Frontend: build green.

backend/src/media_library_viewer_api/integrations/alertmanager.py

@@ -2,17 +2,24 @@
 
 from __future__ import annotations
 
-from typing import Any
+from typing import TYPE_CHECKING, Any
+
+import requests
 
 from media_library_viewer_api.integrations.base import (
     SecretField,
     ServiceBaseUrl,
     ServiceConfigBase,
     ServiceDefinition,
+    TestResult,
     WidgetConfigBase,
+    translate_connection_error,
     widget_kind,
 )
 
+if TYPE_CHECKING:
+    from media_library_viewer_api.services.settings_store import SettingsStore
+
 
 class AlertmanagerConfig(ServiceConfigBase):
     """Non-secret Alertmanager connection config."""
@@ -68,6 +75,28 @@ def summarize_alerts(
     }
 
 
+def test_connection(
+    config: dict[str, Any],
+    secrets: dict[str, str],
+    store: SettingsStore,
+) -> TestResult:
+    """GET /api/v2/status with optional bearer auth."""
+    try:
+        base_url = str(config.get("base_url") or "").rstrip("/")
+        timeout = int(config.get("timeout_seconds") or 5)
+        headers: dict[str, str] = {}
+        api_key = str(secrets.get("api_key") or "")
+        if api_key:
+            headers["Authorization"] = f"Bearer {api_key}"
+        resp = requests.get(f"{base_url}/api/v2/status", headers=headers, timeout=timeout)
+        resp.raise_for_status()
+        payload = resp.json()
+        version = str(payload.get("versionInfo", {}).get("version", "") or "connected")
+        return TestResult(ok=True, detail="Connected to Alertmanager.", evidence=version)
+    except Exception as exc:
+        return translate_connection_error(exc, context="Alertmanager")
+
+
 DEFINITION = ServiceDefinition(
     service_type="alertmanager",
     name="Alertmanager",
@@ -86,4 +115,5 @@ DEFINITION = ServiceDefinition(
             refresh_interval_ms=30_000,
         ),
     ],
+    test_callable=test_connection,
 )