feat(email): generic webhook for all notification emails, hide SMTP UI

- Renamed the password-setup webhook (email_webhook.*, /system/email-webhook-config)
  and made it the single transport for all notification emails.
- New webhook_email_service.py shared by password_setup_service and
  notification_service.
- Wired test validated/rejected, campaign completed, and new-MITRE-technique
  notifications through the webhook (previously dead SMTP code, never triggered).
- Added POST /system/email-webhook-test to send a real test email.
- Hid the Email/SMTP settings tab from the UI (SMTP code kept intact, unused).
- Redact email_webhook.api_key on config export.

backend/app/services/notification_service.py

@@ -245,6 +245,52 @@ def cleanup_old_notifications(db: Session, days: int = 90) -> int:
 # ---------------------------------------------------------------------------
 
 
+def _preference_allows(user: User | None, preference_key: str) -> bool:
+    """True unless the user has explicitly turned *preference_key* off.
+
+    ``notification_preferences`` may be ``None`` (older rows predating the
+    column) or missing individual keys (newer preference toggles added
+    after the DB default was set) — both cases default to "on".
+    """
+    if user is None or not user.email:
+        return False
+    prefs = user.notification_preferences or {}
+    return prefs.get(preference_key, True) is not False
+
+
+def notify_user_by_email(db: Session, user_id, *, preference_key: str, subject: str, message: str) -> None:
+    """Email a single user (by id) if their preferences allow it.
+
+    Best-effort — swallows lookup/send failures so a notification email
+    never breaks whatever workflow step triggered it.
+    """
+    if not user_id:
+        return
+    try:
+        user = db.query(User).filter(User.id == user_id).first()
+        if not _preference_allows(user, preference_key):
+            return
+        from app.services.webhook_email_service import send_webhook_email
+        send_webhook_email(db, to=user.email, subject=subject, message=message, full_name=user.full_name)
+    except Exception:
+        pass  # nosec B110 — email failures never crash the caller
+
+
+def notify_all_users_by_email(db: Session, *, preference_key: str, subject: str, message: str) -> None:
+    """Email every active, opted-in user — for platform-wide events
+    (e.g. a MITRE ATT&CK sync) rather than a single actor's own action.
+    """
+    users = db.query(User).filter(User.is_active == True, User.email.isnot(None)).all()  # noqa: E712
+    for user in users:
+        if not _preference_allows(user, preference_key):
+            continue
+        try:
+            from app.services.webhook_email_service import send_webhook_email
+            send_webhook_email(db, to=user.email, subject=subject, message=message, full_name=user.full_name)
+        except Exception:
+            pass  # nosec B110 — one user's failure must not skip the rest
+
+
 def notify_role_with_email(
     db: Session,
     *,
@@ -387,6 +433,12 @@ def notify_test_state_change(db: Session, test, new_state: str) -> None:
             # Keyword argument: entity_id
             entity_id=test_id,
         )
+        notify_user_by_email(
+            db, creator_id,
+            preference_key="email_on_test_rejected",
+            subject=f"Test Rejected: {test_name}",
+            message=f'Your test "{test_name}" has been rejected. Please review and resubmit.',
+        )
 
     # Alternative: new_state == "validated" and creator_id
     elif new_state == "validated" and creator_id:
@@ -406,3 +458,9 @@ def notify_test_state_change(db: Session, test, new_state: str) -> None:
             # Keyword argument: entity_id
             entity_id=test_id,
         )
+        notify_user_by_email(
+            db, creator_id,
+            preference_key="email_on_test_validated",
+            subject=f"Test Validated: {test_name}",
+            message=f'Your test "{test_name}" has been validated successfully.',
+        )