feat(phases): implement webhooks (6.1), email (7.1), user preferences (7.2)

- Phase 6.1: WebhookConfig model, CRUD router (/api/v1/webhooks, admin-only),
  dispatch_webhook() with HMAC signing; integrated into test validation,
  campaign completion, and MITRE sync job
- Phase 7.1: SMTP email service with send_test_validated_email,
  send_campaign_completed_email, send_new_mitre_techniques_email;
  notify_role_with_email() added to notification_service
- Phase 7.2: notification_preferences and jira_account_id on User model;
  PATCH /users/me/preferences endpoint; Alembic migrations b031phase6 and b032phase7

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/services/notification_service.py

@@ -158,6 +158,40 @@ def cleanup_old_notifications(db: Session, days: int = 90) -> int:
 # ---------------------------------------------------------------------------
 
 
+def notify_role_with_email(
+    db: Session,
+    *,
+    role: str,
+    type: str,
+    title: str,
+    message: str,
+    entity_type: str,
+    entity_id: uuid.UUID,
+    email_fn=None,  # callable(user_email) -> bool, optional
+) -> None:
+    """Send in-app notifications + optional email to all active users with a role."""
+    users = (
+        db.query(User)
+        .filter(User.role == role, User.is_active == True)  # noqa: E712
+        .all()
+    )
+    for user in users:
+        create_notification(
+            db,
+            user_id=user.id,
+            type=type,
+            title=title,
+            message=message,
+            entity_type=entity_type,
+            entity_id=entity_id,
+        )
+        if email_fn and user.email:
+            try:
+                email_fn(user.email)
+            except Exception:
+                pass  # email failures never crash notification flow
+
+
 def notify_test_state_change(db: Session, test, new_state: str) -> None:
     """Dispatch notifications based on a test's new state.