feat(email): generic webhook for all notification emails, hide SMTP UI

- Renamed the password-setup webhook (email_webhook.*, /system/email-webhook-config)
  and made it the single transport for all notification emails.
- New webhook_email_service.py shared by password_setup_service and
  notification_service.
- Wired test validated/rejected, campaign completed, and new-MITRE-technique
  notifications through the webhook (previously dead SMTP code, never triggered).
- Added POST /system/email-webhook-test to send a real test email.
- Hid the Email/SMTP settings tab from the UI (SMTP code kept intact, unused).
- Redact email_webhook.api_key on config export.

backend/tests/test_password_setup_flow.py

@@ -26,19 +26,19 @@ def test_send_password_email_requires_webhook_configured(api, auth_headers, new_
 
 def test_admin_can_configure_password_webhook(api, auth_headers):
     resp = api(
-        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        "patch", "/api/v1/system/email-webhook-config", auth_headers,
         json={"url": "https://example.com/power-automate-hook"},
     )
     assert resp.status_code == 200, resp.text
     assert resp.json()["configured"] is True
 
-    get_resp = api("get", "/api/v1/system/password-webhook-config", auth_headers)
+    get_resp = api("get", "/api/v1/system/email-webhook-config", auth_headers)
     assert get_resp.json()["url"] == "https://example.com/power-automate-hook"
 
 
 def test_admin_can_configure_webhook_api_key(api, auth_headers):
     resp = api(
-        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        "patch", "/api/v1/system/email-webhook-config", auth_headers,
         json={"url": "https://example.com/power-automate-hook", "api_key": "super-secret-key"},
     )
     assert resp.status_code == 200, resp.text
@@ -50,10 +50,10 @@ def test_admin_can_configure_webhook_api_key(api, auth_headers):
 
 def test_send_password_email_sends_api_key_header(api, db, auth_headers, new_user_id):
     api(
-        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        "patch", "/api/v1/system/email-webhook-config", auth_headers,
         json={"url": "https://example.com/power-automate-hook", "api_key": "super-secret-key"},
     )
-    with patch("app.services.password_setup_service.requests.post") as mock_post:
+    with patch("app.services.webhook_email_service.requests.post") as mock_post:
         api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
     call_kwargs = mock_post.call_args
     assert call_kwargs.kwargs["headers"] == {"x-api-key": "super-secret-key"}
@@ -61,11 +61,11 @@ def test_send_password_email_sends_api_key_header(api, db, auth_headers, new_use
 
 def test_send_password_email_posts_to_webhook_and_issues_token(api, db, auth_headers, new_user_id):
     api(
-        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        "patch", "/api/v1/system/email-webhook-config", auth_headers,
         json={"url": "https://example.com/power-automate-hook"},
     )
 
-    with patch("app.services.password_setup_service.requests.post") as mock_post:
+    with patch("app.services.webhook_email_service.requests.post") as mock_post:
         resp = api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
     assert resp.status_code == 200, resp.text
     mock_post.assert_called_once()
@@ -86,10 +86,10 @@ def test_send_password_email_posts_to_webhook_and_issues_token(api, db, auth_hea
 
 def test_set_password_with_valid_token_succeeds(api, db, auth_headers, new_user_id):
     api(
-        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        "patch", "/api/v1/system/email-webhook-config", auth_headers,
         json={"url": "https://example.com/power-automate-hook"},
     )
-    with patch("app.services.password_setup_service.requests.post"):
+    with patch("app.services.webhook_email_service.requests.post"):
         api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
 
     from app.models.password_setup_token import PasswordSetupToken
@@ -115,10 +115,10 @@ def test_set_password_with_valid_token_succeeds(api, db, auth_headers, new_user_
 
 def test_set_password_token_cannot_be_reused(api, db, auth_headers, new_user_id):
     api(
-        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        "patch", "/api/v1/system/email-webhook-config", auth_headers,
         json={"url": "https://example.com/power-automate-hook"},
     )
-    with patch("app.services.password_setup_service.requests.post"):
+    with patch("app.services.webhook_email_service.requests.post"):
         api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
 
     from app.models.password_setup_token import PasswordSetupToken
@@ -150,7 +150,7 @@ def test_set_password_invalid_token_rejected(api):
 
 
 def test_password_webhook_config_requires_admin(api, red_lead_headers):
-    resp = api("get", "/api/v1/system/password-webhook-config", red_lead_headers)
+    resp = api("get", "/api/v1/system/email-webhook-config", red_lead_headers)
     assert resp.status_code == 403