feat(email): HTML branded templates with inline logo, wire remaining notification types

- All webhook emails now render as branded HTML (dark header, inline base64
  Aegis logo, card layout, CTA-button links) instead of plain text.
- Wired the 7 remaining notification-preference keys that had no trigger:
  stale coverage alerts, campaign-activated assignment emails, generic
  test-state-change steps (execution started / blue evaluating / in review),
  all-team-validation broadcasts on every lead vote, webhook delivery
  failures (3rd consecutive failure), new user registration, and background
  job errors (APScheduler global error listener).
- New notify_roles_by_email() helper for role-scoped, preference-gated,
  actor-excludable broadcasts.
- Fixed apscheduler.events stubbing gaps in several test files' sys.modules
  fakes that broke full-suite collection after adding the APScheduler
  error-listener import.

backend/app/services/webhook_email_service.py

@@ -5,8 +5,9 @@ platform (password setup/reset, test validated, campaign completed, new
 MITRE techniques synced, etc.) goes through ``send_webhook_email`` here,
 which POSTs a ``{to, subject, body}`` JSON payload to a single configured
 webhook URL — intended for a Power Automate flow that actually delivers
-the email. An optional API key, if configured, is sent as an
-``x-api-key`` header.
+the email (the ``body`` is full HTML; the flow's "send email" step must
+have its "Is HTML" option enabled). An optional API key, if configured,
+is sent as an ``x-api-key`` header.
 
 SMTP (``app.services.email_service``) is intentionally left in place but
 unused and unreachable from the UI — see that module's docstring.
@@ -14,7 +15,11 @@ unused and unreachable from the UI — see that module's docstring.
 
 from __future__ import annotations
 
+import base64
+import html as html_lib
 import logging
+import re
+from pathlib import Path
 
 import requests
 from sqlalchemy.orm import Session
@@ -24,22 +29,91 @@ logger = logging.getLogger(__name__)
 _WEBHOOK_URL_CONFIG_KEY = "email_webhook.url"
 _WEBHOOK_API_KEY_CONFIG_KEY = "email_webhook.api_key"
 
-# Standard greeting + footer wrapped around every notification email's
-# actual message, matching the platform's established template.
-_EMAIL_SIGNATURE = (
-    "\n\nRegards,\n"
-    "AEGIS Security Platform\n"
-    "Purple Team Engineering\n"
-    "Owned and operated by Enterprise Corp.\n\n"
-    "Assume breach. Validate controls. Improve continuously.\n\n"
-    "This is an automated notification. Please do not reply."
-)
+_LOGO_PATH = Path(__file__).resolve().parent.parent / "assets" / "email_logo.png"
+_URL_RE = re.compile(r"^https?://\S+$")
+
+_logo_b64_cache: str | None = None
+
+
+def _get_logo_base64() -> str:
+    """Read + cache the inline email logo as a base64 string (empty if missing)."""
+    global _logo_b64_cache
+    if _logo_b64_cache is None:
+        try:
+            _logo_b64_cache = base64.b64encode(_LOGO_PATH.read_bytes()).decode("ascii")
+        except OSError:
+            logger.warning("Email logo asset missing at %s", _LOGO_PATH)
+            _logo_b64_cache = ""
+    return _logo_b64_cache
+
+
+def _message_to_html(message: str) -> str:
+    """Turn a plain-text message (paragraphs separated by blank lines) into
+    escaped HTML, rendering any lone-URL paragraph as a call-to-action button.
+    """
+    parts: list[str] = []
+    for para in message.strip().split("\n\n"):
+        para = para.strip()
+        if not para:
+            continue
+        if _URL_RE.match(para):
+            url = html_lib.escape(para, quote=True)
+            parts.append(
+                f'<p style="margin:0 0 20px;">'
+                f'<a href="{url}" style="display:inline-block;background-color:#0891b2;'
+                f'color:#ffffff;text-decoration:none;padding:12px 24px;border-radius:6px;'
+                f'font-weight:600;font-size:14px;">Open Link &rarr;</a>'
+                f'</p>'
+            )
+        else:
+            escaped = html_lib.escape(para).replace("\n", "<br>")
+            parts.append(f'<p style="margin:0 0 16px;">{escaped}</p>')
+    return "".join(parts)
 
 
 def build_email_body(full_name: str | None, message: str) -> str:
-    """Wrap *message* in the standard greeting + signature template."""
-    greeting = full_name or "there"
-    return f"HI {greeting}\n\n{message}{_EMAIL_SIGNATURE}"
+    """Wrap *message* in Aegis's branded HTML email template (inline logo)."""
+    greeting = html_lib.escape(full_name) if full_name else "there"
+    message_html = _message_to_html(message)
+    logo_b64 = _get_logo_base64()
+    logo_tag = (
+        f'<img src="data:image/png;base64,{logo_b64}" width="56" height="57" alt="Aegis" '
+        f'style="display:block;margin:0 auto 10px;border:0;" />'
+        if logo_b64
+        else ""
+    )
+    return f"""<!DOCTYPE html>
+<html>
+  <body style="margin:0;padding:0;background-color:#0b0f19;font-family:'Segoe UI',Helvetica,Arial,sans-serif;">
+    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background-color:#0b0f19;padding:32px 0;">
+      <tr>
+        <td align="center">
+          <table role="presentation" width="560" cellpadding="0" cellspacing="0" style="max-width:560px;width:100%;background-color:#111827;border-radius:12px;overflow:hidden;border:1px solid #1f2937;">
+            <tr>
+              <td style="background-color:#0e7490;background-image:linear-gradient(135deg,#0e7490,#0891b2);padding:28px 32px;text-align:center;">
+                {logo_tag}
+                <div style="color:#ffffff;font-size:20px;font-weight:700;letter-spacing:1px;">AEGIS SECURITY PLATFORM</div>
+                <div style="color:#cffafe;font-size:11px;letter-spacing:2px;text-transform:uppercase;margin-top:4px;">Purple Team Engineering</div>
+              </td>
+            </tr>
+            <tr>
+              <td style="padding:32px;">
+                <p style="color:#e5e7eb;font-size:16px;margin:0 0 16px;">Hi {greeting},</p>
+                <div style="color:#d1d5db;font-size:14px;line-height:1.6;">{message_html}</div>
+              </td>
+            </tr>
+            <tr>
+              <td style="padding:20px 32px;background-color:#0b0f19;border-top:1px solid #1f2937;">
+                <p style="color:#67e8f9;font-size:12px;margin:0 0 8px;font-style:italic;">Assume breach. Validate controls. Improve continuously.</p>
+                <p style="color:#4b5563;font-size:11px;margin:0;">Owned and operated by Enterprise Corp. This is an automated notification &mdash; please do not reply.</p>
+              </td>
+            </tr>
+          </table>
+        </td>
+      </tr>
+    </table>
+  </body>
+</html>"""
 
 
 def _read_system_config(db: Session, key: str) -> str | None: