Alert-rail per-app routing for terra errors

Shared enamel/terra Supabase DB has no applog-listen unit for either app. bin-venus-cc's proposed fix (one @enamel instance) covers row pickup for both but misroutes terra's error/security appEvents to enamel's PM (per-unit identity=pm:enamel/aro:enamel). Needs per-app routing before terra counts as alerted; do not accept enamel-routes-for-both as covered. Not urgent — terra has zero users, auth unexercised.