feat(notifications): JSON-safe webhook template, SMTP timeout and implicit TLS, test-send buttons (#5064)

#5064 "Notifications that arrive":
- render_webhook: alert.* is escaped to sit inside a JSON string (a quote
  or newline in a rule name no longer breaks the body); raw.* is the plain
  value for |tojson; a missing value reads "no data"; the template runs
  sandboxed and the body is checked to be JSON before it is sent.
- SMTP: 15s timeout; port 465 connects with implicit TLS, otherwise the
  box means STARTTLS; a From address setting (falls back to the username).
- A webhook error no longer carries the URL, which is a secret.
- Settings → Notifications: "Send a test email" / "Send a test webhook"
  send a sample alert with the form's values (unsaved) and show the result
  and the body that went out; template help names alert.* and raw.*.
- Notification audits go through audit_request; the test send is audited
  as settings.notification.tested, with the channel and outcome only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/settings/notifications.html

@@ -28,9 +28,11 @@
       <div class="form-group" style="display:flex;align-items:center;gap:0.5rem;padding-top:1.5rem;">
         <input type="checkbox" name="smtp.tls" id="smtp-tls"
                {% if settings['smtp.tls'] %}checked{% endif %}>
-        <label for="smtp-tls" style="margin:0;">Use TLS</label>
+        <label for="smtp-tls" style="margin:0;">Use STARTTLS</label>
       </div>
     </div>
+    <p style="font-size:0.75rem;color:var(--text-muted);margin:-0.5rem 0 1rem;">
+      Port 465 always connects with implicit TLS; on other ports the box upgrades the connection with STARTTLS.</p>
 
     <div class="form-group">
       <label>Username</label>
@@ -43,12 +45,23 @@
       <input type="password" name="smtp.password" placeholder="••••••••" autocomplete="new-password">
     </div>
 
+    <div class="form-group">
+      <label>From address <span style="color:var(--text-muted);font-size:0.8rem;">(blank uses the username)</span></label>
+      <input type="text" name="smtp.from" value="{{ settings['smtp.from'] }}"
+             placeholder="steward@example.com">
+    </div>
+
     <div class="form-group">
       <label>Recipients <span style="color:var(--text-muted);font-size:0.8rem;">(comma-separated)</span></label>
       <input type="text" name="smtp.recipients"
              value="{{ settings['smtp.recipients'] | join(', ') }}"
              placeholder="admin@example.com, ops@example.com">
     </div>
+
+    <button type="button" class="btn btn-ghost" hx-post="/settings/notifications/test-email"
+            hx-include="closest form" hx-target="#email-test-result" hx-swap="innerHTML">
+      Send a test email</button>
+    <div id="email-test-result"></div>
   </div>
 
   {# ── Webhook ───────────────────────────────────────────────────────────── #}
@@ -73,7 +86,17 @@
       <label>Payload template <span style="color:var(--text-muted);font-size:0.8rem;">(Jinja2, must produce valid JSON)</span></label>
       <textarea name="webhook.template" rows="4"
                 style="font-family:ui-monospace,monospace;font-size:0.85rem;">{{ settings['webhook.template'] }}</textarea>
+      <p style="font-size:0.75rem;color:var(--text-muted);margin-top:0.2rem;">
+        <code>{{ '{{ alert.rule_name }}' }}</code> is escaped to sit inside a JSON string, so quotes or
+        line breaks in a name can't break the body; a missing value reads "no data".
+        For a bare JSON value use <code>{{ '{{ raw.value | tojson }}' }}</code> (a number, or null).
+        Fields: state, rule_name, resource, metric, value, threshold, source_module, note, timestamp.</p>
     </div>
+
+    <button type="button" class="btn btn-ghost" hx-post="/settings/notifications/test-webhook"
+            hx-include="closest form" hx-target="#webhook-test-result" hx-swap="innerHTML">
+      Send a test webhook</button>
+    <div id="webhook-test-result"></div>
   </div>
 
 </div>