feat(email): generic webhook for all notification emails, hide SMTP UI

- Renamed the password-setup webhook (email_webhook.*, /system/email-webhook-config)
  and made it the single transport for all notification emails.
- New webhook_email_service.py shared by password_setup_service and
  notification_service.
- Wired test validated/rejected, campaign completed, and new-MITRE-technique
  notifications through the webhook (previously dead SMTP code, never triggered).
- Added POST /system/email-webhook-test to send a real test email.
- Hid the Email/SMTP settings tab from the UI (SMTP code kept intact, unused).
- Redact email_webhook.api_key on config export.

backend/app/services/webhook_email_service.py

@@ -0,0 +1,112 @@
+"""Generic outbound-email sender — POSTs to an admin-configured webhook.
+
+Replaces the old SMTP-based email system. Every notification email in the
+platform (password setup/reset, test validated, campaign completed, new
+MITRE techniques synced, etc.) goes through ``send_webhook_email`` here,
+which POSTs a ``{to, subject, body}`` JSON payload to a single configured
+webhook URL — intended for a Power Automate flow that actually delivers
+the email. An optional API key, if configured, is sent as an
+``x-api-key`` header.
+
+SMTP (``app.services.email_service``) is intentionally left in place but
+unused and unreachable from the UI — see that module's docstring.
+"""
+
+from __future__ import annotations
+
+import logging
+
+import requests
+from sqlalchemy.orm import Session
+
+logger = logging.getLogger(__name__)
+
+_WEBHOOK_URL_CONFIG_KEY = "email_webhook.url"
+_WEBHOOK_API_KEY_CONFIG_KEY = "email_webhook.api_key"
+
+# Standard greeting + footer wrapped around every notification email's
+# actual message, matching the platform's established template.
+_EMAIL_SIGNATURE = (
+    "\n\nRegards,\n"
+    "AEGIS Security Platform\n"
+    "Purple Team Engineering\n"
+    "Owned and operated by Enterprise Corp.\n\n"
+    "Assume breach. Validate controls. Improve continuously.\n\n"
+    "This is an automated notification. Please do not reply."
+)
+
+
+def build_email_body(full_name: str | None, message: str) -> str:
+    """Wrap *message* in the standard greeting + signature template."""
+    greeting = full_name or "there"
+    return f"HI {greeting}\n\n{message}{_EMAIL_SIGNATURE}"
+
+
+def _read_system_config(db: Session, key: str) -> str | None:
+    from app.models.system_config import SystemConfig  # avoid circular at import time
+
+    row = db.query(SystemConfig).filter(SystemConfig.key == key).first()
+    return row.value if row else None
+
+
+def _write_system_config(db: Session, key: str, value: str) -> None:
+    from app.models.system_config import SystemConfig
+
+    row = db.query(SystemConfig).filter(SystemConfig.key == key).first()
+    if row:
+        row.value = value
+    else:
+        db.add(SystemConfig(key=key, value=value))
+
+
+def get_webhook_url(db: Session) -> str | None:
+    """Return the configured Power-Automate-style webhook URL, or None."""
+    return _read_system_config(db, _WEBHOOK_URL_CONFIG_KEY) or None
+
+
+def set_webhook_url(db: Session, url: str) -> None:
+    """Persist the webhook URL. Does not commit; caller commits."""
+    _write_system_config(db, _WEBHOOK_URL_CONFIG_KEY, url)
+
+
+def get_webhook_api_key(db: Session) -> str | None:
+    """Return the configured webhook API key, or None."""
+    return _read_system_config(db, _WEBHOOK_API_KEY_CONFIG_KEY) or None
+
+
+def set_webhook_api_key(db: Session, api_key: str) -> None:
+    """Persist the webhook API key. Does not commit; caller commits."""
+    _write_system_config(db, _WEBHOOK_API_KEY_CONFIG_KEY, api_key)
+
+
+def send_webhook_email(
+    db: Session, *, to: str | None, subject: str, message: str, full_name: str | None = None,
+) -> bool:
+    """POST a notification email to the configured webhook.
+
+    Best-effort: returns False (and logs a warning) if no webhook is
+    configured, *to* is empty, or the request fails — never raises, since
+    a webhook outage must not break whatever triggered the notification.
+    """
+    if not to:
+        return False
+
+    webhook_url = get_webhook_url(db)
+    if not webhook_url:
+        logger.warning("Email webhook is not configured — dropping email to %s", to)
+        return False
+
+    api_key = get_webhook_api_key(db)
+    headers = {"x-api-key": api_key} if api_key else {}
+
+    try:
+        requests.post(
+            webhook_url,
+            json={"to": to, "subject": subject, "body": build_email_body(full_name, message)},
+            headers=headers,
+            timeout=10,
+        )
+        return True
+    except requests.RequestException:
+        logger.warning("Email webhook call failed for %s", to, exc_info=True)
+        return False