feat(email): HTML branded templates with inline logo, wire remaining notification types

- All webhook emails now render as branded HTML (dark header, inline base64
  Aegis logo, card layout, CTA-button links) instead of plain text.
- Wired the 7 remaining notification-preference keys that had no trigger:
  stale coverage alerts, campaign-activated assignment emails, generic
  test-state-change steps (execution started / blue evaluating / in review),
  all-team-validation broadcasts on every lead vote, webhook delivery
  failures (3rd consecutive failure), new user registration, and background
  job errors (APScheduler global error listener).
- New notify_roles_by_email() helper for role-scoped, preference-gated,
  actor-excludable broadcasts.
- Fixed apscheduler.events stubbing gaps in several test files' sys.modules
  fakes that broke full-suite collection after adding the APScheduler
  error-listener import.

backend/app/services/webhook_service.py

@@ -184,6 +184,19 @@ def _send_webhook(db, wh: WebhookConfig, event_type: str, payload: dict) -> None
             "Webhook '%s' (%s) failed for event=%s: %s (failure_count=%d)",
             wh.name, wh.url, event_type, exc, wh.failure_count,
         )
+        if wh.failure_count == 3:
+            # Email once on the 3rd consecutive failure — signals "this looks
+            # broken", without alerting on every transient single failure.
+            from app.services.notification_service import notify_roles_by_email
+            notify_roles_by_email(
+                db, roles=["admin"],
+                preference_key="email_on_webhook_failures",
+                subject=f"Webhook Delivery Failing: {wh.name}",
+                message=(
+                    f'The webhook "{wh.name}" ({wh.url}) has failed {wh.failure_count} times '
+                    f'in a row for event "{event_type}". Last error: {exc}'
+                ),
+            )
 
 
 # ---------------------------------------------------------------------------