feat(email): generic webhook for all notification emails, hide SMTP UI

- Renamed the password-setup webhook (email_webhook.*, /system/email-webhook-config)
  and made it the single transport for all notification emails.
- New webhook_email_service.py shared by password_setup_service and
  notification_service.
- Wired test validated/rejected, campaign completed, and new-MITRE-technique
  notifications through the webhook (previously dead SMTP code, never triggered).
- Added POST /system/email-webhook-test to send a real test email.
- Hid the Email/SMTP settings tab from the UI (SMTP code kept intact, unused).
- Redact email_webhook.api_key on config export.

backend/app/routers/admin_config.py

@@ -41,6 +41,7 @@ _REDACTED_KEYS = {
     "smtp.password",
     "jira.admin_api_token",
     "tempo.admin_token",
+    "email_webhook.api_key",
     # Older/alternate key names kept defensively in case a prior schema
     # version wrote under these instead.
     "jira.api_token",