[BUG]Security Analytics: Query index alias deleted on detector removal, causing rollover and IndexNotFoundException

Title
Security Analytics: Query index alias deleted on detector removal, causing rollover and IndexNotFoundException

Environment
OS: Ubuntu

OpenSearch: 2.15.0

Plugin: Security Analytics

Steps to Reproduce
Create a new log type (e.g., log type 1).

Create a rule (e.g., rule 1).

Create detector A using log type 1 and attach rule 1.

Observe query index .opensearch--detectors-queries-000001 created.

Stop detector A and remove rules.

Index 000001 is deleted.

Create detector B with the same log type.

Observe new query index 000002 created.

Add a rule back to detector A and enable it.

Observe new query index 000003 created.

Delete detector A.

Alias .opensearch--detectors-queries is deleted entirely.

Try to update detector B.

Error: IndexNotFoundException [.opensearch--detectors-queries].

Try to create another detector with the same log type.

Error: Failed to get write index for queryIndex alias.

Expected Behavior
Alias .opensearch--detectors-queries should persist across detector deletions.

Rollover should only occur when thresholds (size, age, docs) are met, not on every detector creation.

Detectors should reuse the same alias and write index chain for a given log type.

Actual Behavior
Alias is deleted when a detector is removed.

Every new detector creation forces a rollover (000001 → 000002 → 000003…).

Remaining detectors fail with IndexNotFoundException.

Impact
Detectors for the same log type cannot coexist reliably.

Alias lifecycle is incorrectly tied to detector lifecycle instead of log type lifecycle.

Breaks multi-detector setups and prevents stable query index reuse.

Suggested Fix
Decouple alias lifecycle from detector lifecycle.

Ensure alias persists as long as the log type exists.

Trigger rollover only when thresholds are met, not on detector creation.

Allow detectors to reuse the same alias chain.

No source files or tests are named. Start by reproducing the detector and log-type sequence in the issue, then trace query-index alias creation, rollover, and deletion. Done means the alias persists while the log type exists, detectors reuse its write-index chain, and rollover occurs only when size, age, or document thresholds are met.