feat(email): generic webhook for all notification emails, hide SMTP UI

- Renamed the password-setup webhook (email_webhook.*, /system/email-webhook-config)
  and made it the single transport for all notification emails.
- New webhook_email_service.py shared by password_setup_service and
  notification_service.
- Wired test validated/rejected, campaign completed, and new-MITRE-technique
  notifications through the webhook (previously dead SMTP code, never triggered).
- Added POST /system/email-webhook-test to send a real test email.
- Hid the Email/SMTP settings tab from the UI (SMTP code kept intact, unused).
- Redact email_webhook.api_key on config export.

backend/app/services/password_setup_service.py

@@ -2,88 +2,27 @@
 
 An admin creates a user with just a name/email/role (see
 ``user_service.create_user_without_password``). To let that user in, the
-admin clicks "Send Email": this service issues a one-time token and POSTs
-a payload carrying it to an admin-configured webhook URL (intended for a
-Power Automate flow that actually sends the email — the exact webhook
-contract is still being finalized, hence the configurable URL rather than
-a hardcoded integration). The same mechanism, and the same button, is
+admin clicks "Send Email": this service issues a one-time token and sends
+it via the shared ``webhook_email_service`` (POSTs to an admin-configured
+Power Automate webhook). The same mechanism, and the same button, is
 reused for password resets on existing users.
 """
 
 from __future__ import annotations
 
-import logging
 import secrets
 from datetime import datetime, timedelta
 
-import requests
 from sqlalchemy.orm import Session
 
 from app.config import settings
 from app.domain.errors import BusinessRuleViolation, EntityNotFoundError
 from app.models.password_setup_token import PasswordSetupToken
 from app.models.user import User
+from app.services.webhook_email_service import get_webhook_url, send_webhook_email
 
-logger = logging.getLogger(__name__)
-
-_WEBHOOK_URL_CONFIG_KEY = "password_setup.webhook_url"
-_WEBHOOK_API_KEY_CONFIG_KEY = "password_setup.webhook_api_key"
 _TOKEN_TTL = timedelta(hours=24)
 
-# Standard footer appended to every Power-Automate-delivered notification
-# email, matching the platform's established template.
-_EMAIL_SIGNATURE = (
-    "\n\nRegards,\n"
-    "AEGIS Security Platform\n"
-    "Purple Team Engineering\n"
-    "Owned and operated by Enterprise Corp.\n\n"
-    "Assume breach. Validate controls. Improve continuously.\n\n"
-    "This is an automated notification. Please do not reply."
-)
-
-
-def _build_email_body(full_name: str | None, message: str) -> str:
-    """Wrap *message* in the standard greeting + signature template."""
-    greeting = full_name or "there"
-    return f"HI {greeting}\n\n{message}{_EMAIL_SIGNATURE}"
-
-
-def _read_system_config(db: Session, key: str) -> str | None:
-    from app.models.system_config import SystemConfig  # avoid circular at import time
-
-    row = db.query(SystemConfig).filter(SystemConfig.key == key).first()
-    return row.value if row else None
-
-
-def _write_system_config(db: Session, key: str, value: str) -> None:
-    from app.models.system_config import SystemConfig
-
-    row = db.query(SystemConfig).filter(SystemConfig.key == key).first()
-    if row:
-        row.value = value
-    else:
-        db.add(SystemConfig(key=key, value=value))
-
-
-def get_password_webhook_url(db: Session) -> str | None:
-    """Return the configured Power-Automate-style webhook URL, or None."""
-    return _read_system_config(db, _WEBHOOK_URL_CONFIG_KEY) or None
-
-
-def set_password_webhook_url(db: Session, url: str) -> None:
-    """Persist the webhook URL. Does not commit; caller commits."""
-    _write_system_config(db, _WEBHOOK_URL_CONFIG_KEY, url)
-
-
-def get_password_webhook_api_key(db: Session) -> str | None:
-    """Return the configured webhook API key, or None."""
-    return _read_system_config(db, _WEBHOOK_API_KEY_CONFIG_KEY) or None
-
-
-def set_password_webhook_api_key(db: Session, api_key: str) -> None:
-    """Persist the webhook API key. Does not commit; caller commits."""
-    _write_system_config(db, _WEBHOOK_API_KEY_CONFIG_KEY, api_key)
-
 
 def create_setup_token(db: Session, user: User) -> PasswordSetupToken:
     """Issue a fresh one-time token for *user*, invalidating any unused ones.
@@ -106,16 +45,15 @@ def create_setup_token(db: Session, user: User) -> PasswordSetupToken:
 
 
 def send_password_setup_email(db: Session, user: User) -> None:
-    """Issue a token and POST it to the configured webhook.
+    """Issue a token and email it via the configured webhook.
 
-    Raises BusinessRuleViolation if no webhook URL is configured yet.
+    Raises BusinessRuleViolation if no webhook is configured yet.
     Does not commit; caller commits (the token must be persisted even if
     the webhook call itself fails, so a fresh "Send Email" retry works).
     """
-    webhook_url = get_password_webhook_url(db)
-    if not webhook_url:
+    if not get_webhook_url(db):
         raise BusinessRuleViolation(
-            "No password-setup webhook is configured yet — set one in Settings first."
+            "No email webhook is configured yet — set one in Settings first."
         )
 
     token = create_setup_token(db, user)
@@ -127,25 +65,7 @@ def send_password_setup_email(db: Session, user: User) -> None:
         f"{set_password_url}\n\n"
         "This link expires in 24 hours and can only be used once."
     )
-
-    api_key = get_password_webhook_api_key(db)
-    headers = {"x-api-key": api_key} if api_key else {}
-
-    try:
-        requests.post(
-            webhook_url,
-            json={
-                "to": user.email,
-                "subject": subject,
-                "body": _build_email_body(user.full_name, message),
-            },
-            headers=headers,
-            timeout=10,
-        )
-    except requests.RequestException:
-        # Best-effort: the token still exists, so the admin can retry
-        # "Send Email" once the webhook endpoint is reachable again.
-        logger.warning("Password-setup webhook call failed for user %s", user.id, exc_info=True)
+    send_webhook_email(db, to=user.email, subject=subject, message=message, full_name=user.full_name)
 
 
 def _get_valid_token_or_raise(db: Session, token: str) -> PasswordSetupToken: