feat(email): HTML branded templates with inline logo, wire remaining notification types

- All webhook emails now render as branded HTML (dark header, inline base64
  Aegis logo, card layout, CTA-button links) instead of plain text.
- Wired the 7 remaining notification-preference keys that had no trigger:
  stale coverage alerts, campaign-activated assignment emails, generic
  test-state-change steps (execution started / blue evaluating / in review),
  all-team-validation broadcasts on every lead vote, webhook delivery
  failures (3rd consecutive failure), new user registration, and background
  job errors (APScheduler global error listener).
- New notify_roles_by_email() helper for role-scoped, preference-gated,
  actor-excludable broadcasts.
- Fixed apscheduler.events stubbing gaps in several test files' sys.modules
  fakes that broke full-suite collection after adding the APScheduler
  error-listener import.

backend/app/services/operational_alert_service.py

@@ -29,7 +29,7 @@ log = logging.getLogger(__name__)
 
 def _dispatch_inapp_notifications(db: Session, rule: AlertRule, instance: AlertInstance) -> None:
     """Create in-app Notification rows for all admins and leads."""
-    from app.services.notification_service import create_notification
+    from app.services.notification_service import create_notification, notify_roles_by_email
 
     admin_roles = {"admin", "red_lead", "blue_lead"}
     users = db.query(User).filter(
@@ -47,6 +47,14 @@ def _dispatch_inapp_notifications(db: Session, rule: AlertRule, instance: AlertI
             entity_id  = instance.id,
         )
 
+    if rule.rule_type == AlertRuleType.stale_technique.value:
+        notify_roles_by_email(
+            db, roles=list(admin_roles),
+            preference_key="email_on_stale_coverage",
+            subject=instance.title,
+            message=instance.message,
+        )
+
 
 def _dispatch_webhooks(rule: AlertRule, instance: AlertInstance) -> None:
     """Fire webhook(s) for a triggered alert (all exceptions caught)."""