feat(notifications): JSON-safe webhook template, SMTP timeout and implicit TLS, test-send buttons (#5064)

#5064 "Notifications that arrive":
- render_webhook: alert.* is escaped to sit inside a JSON string (a quote
  or newline in a rule name no longer breaks the body); raw.* is the plain
  value for |tojson; a missing value reads "no data"; the template runs
  sandboxed and the body is checked to be JSON before it is sent.
- SMTP: 15s timeout; port 465 connects with implicit TLS, otherwise the
  box means STARTTLS; a From address setting (falls back to the username).
- A webhook error no longer carries the URL, which is a secret.
- Settings → Notifications: "Send a test email" / "Send a test webhook"
  send a sample alert with the form's values (unsaved) and show the result
  and the body that went out; template help names alert.* and raw.*.
- Notification audits go through audit_request; the test send is audited
  as settings.notification.tested, with the channel and outcome only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/core/settings.py

@@ -55,6 +55,7 @@ DEFAULTS: dict[str, Any] = {
     "smtp.username": "",
     "smtp.password": "",
     "smtp.recipients": [],
+    "smtp.from": "",
     "webhook.url": "",
     "webhook.template": _DEFAULT_WEBHOOK_TEMPLATE,
     "ansible.sources": [],
@@ -370,6 +371,7 @@ def to_smtp_cfg(settings: dict[str, Any]) -> dict:
         "username": settings.get("smtp.username", ""),
         "password": settings.get("smtp.password", ""),
         "recipients": settings.get("smtp.recipients", []),
+        "from": settings.get("smtp.from", ""),
     }