feat(email): HTML branded templates with inline logo, wire remaining notification types

- All webhook emails now render as branded HTML (dark header, inline base64
  Aegis logo, card layout, CTA-button links) instead of plain text.
- Wired the 7 remaining notification-preference keys that had no trigger:
  stale coverage alerts, campaign-activated assignment emails, generic
  test-state-change steps (execution started / blue evaluating / in review),
  all-team-validation broadcasts on every lead vote, webhook delivery
  failures (3rd consecutive failure), new user registration, and background
  job errors (APScheduler global error listener).
- New notify_roles_by_email() helper for role-scoped, preference-gated,
  actor-excludable broadcasts.
- Fixed apscheduler.events stubbing gaps in several test files' sys.modules
  fakes that broke full-suite collection after adding the APScheduler
  error-listener import.

backend/tests/test_integration_v2.py

@@ -97,11 +97,17 @@ if "apscheduler.schedulers.background" not in sys.modules:
     _apsched = ModuleType("apscheduler.schedulers.background")
     class _FakeBGScheduler:
         def add_job(self, *a, **kw): pass
+        def add_listener(self, *a, **kw): pass
         def start(self): pass
         def shutdown(self, **kw): pass
     _apsched.BackgroundScheduler = _FakeBGScheduler
     sys.modules["apscheduler.schedulers.background"] = _apsched
 
+if "apscheduler.events" not in sys.modules:
+    _apsched_events = ModuleType("apscheduler.events")
+    _apsched_events.EVENT_JOB_ERROR = 1
+    sys.modules["apscheduler.events"] = _apsched_events
+
 if "taxii2client" not in sys.modules:
     sys.modules["taxii2client"] = ModuleType("taxii2client")
 if "taxii2client.v20" not in sys.modules: