fix(alerts): harden with security fixes, design compliance, and test coverage (#570)

* fix(alerts): harden with security fixes, design compliance, and test coverage

Add authMiddleware to all alert endpoints, validate notification test
dispatch inputs, fix restart_count metric via Docker inspect, correct
network metric units, replace any types with DockerContainerStats
interface, add webhook timeouts and dispatch error tracking.

Frontend: migrate Select to Combobox, add ScrollArea and delete
confirmation AlertDialog, fix icon strokeWidth to 1.5.

Add update availability notifications for both Sencho version updates
(6-hour check in MonitorService) and stack image updates (state
transition detection in ImageUpdateService). Extract shared version
fetch logic into utils/version-check.ts.

Add diagnostic logging gated behind developer_mode for MonitorService
breach state machine and NotificationService dispatch routing.

Tests: 24 new alert API integration tests, restart_count and version
check unit tests (688 total passing). Docs updated with HTTPS
requirement, update notifications section, and troubleshooting guide.

* fix(alerts): remove unused TEST_USERNAME import in alerts-api tests

backend/src/services/NotificationService.ts

@@ -1,4 +1,12 @@
 import { DatabaseService, NotificationHistory } from './DatabaseService';
+import { isDebugEnabled } from '../utils/debug';
+import { getErrorMessage } from '../utils/errors';
+
+/** Webhook timeout: 10 seconds per external dispatch call. */
+const WEBHOOK_TIMEOUT_MS = 10_000;
+
+/** Valid notification channel types for defense-in-depth validation. */
+const ALLOWED_CHANNEL_TYPES = new Set(['discord', 'slack', 'webhook']);
 
 export class NotificationService {
     private static instance: NotificationService;
@@ -21,6 +29,16 @@ export class NotificationService {
         this.broadcaster = fn;
     }
 
+    /**
+     * Dispatch an alert: log to history, push via WebSocket, and route to
+     * external channels.
+     *
+     * Routing uses two tiers that coexist intentionally:
+     *  - notification_routes (Admiral tier): per-stack pattern-based routing
+     *    with priority ordering. If any route matches, global agents are skipped.
+     *  - agents table (all tiers): global fallback channels used when no
+     *    notification_routes match or when no stackName is provided.
+     */
     public async dispatchAlert(level: 'info' | 'warning' | 'error', message: string, stackName?: string) {
         // 1. Log to history and get the full inserted record (with id)
         const notification = this.dbService.addNotificationHistory({
@@ -35,16 +53,26 @@ export class NotificationService {
         }
 
         // 3. Check notification routing rules if a stack context is available
+        const errors: string[] = [];
+
         if (stackName) {
             const routes = this.dbService.getEnabledNotificationRoutes();
             const matched = routes.filter(r => r.stack_patterns.includes(stackName));
             if (matched.length > 0) {
+                if (isDebugEnabled()) console.log(`[Notify:diag] Matched ${matched.length} route(s) for stack "${stackName}"`);
                 await Promise.allSettled(
                     matched.map(route =>
                         this.sendToChannel(route.channel_type, route.channel_url, level, message)
-                            .catch(error => console.error(`Failed to dispatch notification via route "${route.name}":`, error))
+                            .then(() => {
+                                if (isDebugEnabled()) console.log(`[Notify:diag] Dispatched ${level} via route "${route.name}" (${route.channel_type})`);
+                            })
+                            .catch(error => {
+                                console.error(`Failed to dispatch notification via route "${route.name}":`, error);
+                                errors.push(`Route "${route.name}": ${getErrorMessage(error, String(error))}`);
+                            })
                     )
                 );
+                this.recordDispatchErrors(notification.id!, errors);
                 return;
             }
         }
@@ -52,16 +80,35 @@ export class NotificationService {
         // 4. Fall back to global agents
         const agents = this.dbService.getEnabledAgents();
         if (agents.length === 0) {
-            console.log('No active notification agents found. Skipping external dispatch.');
+            if (isDebugEnabled()) console.log('[Notify:diag] No routes or agents matched; skipping external dispatch');
             return;
         }
 
+        if (isDebugEnabled()) console.log(`[Notify:diag] Falling back to ${agents.length} global agent(s)`);
         await Promise.allSettled(
             agents.map(agent =>
                 this.sendToChannel(agent.type, agent.url, level, message)
-                    .catch(error => console.error(`Failed to dispatch notification to ${agent.type}:`, error))
+                    .then(() => {
+                        if (isDebugEnabled()) console.log(`[Notify:diag] Dispatched ${level} via global agent (${agent.type})`);
+                    })
+                    .catch(error => {
+                        console.error(`Failed to dispatch notification to ${agent.type}:`, error);
+                        errors.push(`${agent.type}: ${getErrorMessage(error, String(error))}`);
+                    })
             )
         );
+        this.recordDispatchErrors(notification.id!, errors);
+    }
+
+    /** Persist dispatch errors to the notification record for user visibility. */
+    private recordDispatchErrors(notificationId: number, errors: string[]) {
+        if (errors.length > 0) {
+            try {
+                this.dbService.updateNotificationDispatchError(notificationId, errors.join('; '));
+            } catch (e) {
+                console.error('[Notify] Failed to record dispatch error:', e);
+            }
+        }
     }
 
     private async sendToChannel(type: string, url: string, level: 'info' | 'warning' | 'error', message: string): Promise<void> {
@@ -71,10 +118,14 @@ export class NotificationService {
             await this.sendSlackWebhook(url, level, message);
         } else if (type === 'webhook') {
             await this.sendCustomWebhook(url, level, message);
+        } else {
+            throw new Error(`Unsupported channel type: ${type}`);
         }
     }
 
     public async testDispatch(type: 'discord' | 'slack' | 'webhook', url: string) {
+        if (!ALLOWED_CHANNEL_TYPES.has(type)) throw new Error(`Invalid notification type: ${type}`);
+        if (!url || !url.startsWith('https://')) throw new Error('URL must use HTTPS');
         await this.sendToChannel(type, url, 'info', '🔌 Test Notification from Sencho!');
     }
 
@@ -97,7 +148,8 @@ export class NotificationService {
         const response = await fetch(url, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify(payload)
+            body: JSON.stringify(payload),
+            signal: AbortSignal.timeout(WEBHOOK_TIMEOUT_MS),
         });
 
         if (!response.ok) {
@@ -119,7 +171,8 @@ export class NotificationService {
         const response = await fetch(url, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify(payload)
+            body: JSON.stringify(payload),
+            signal: AbortSignal.timeout(WEBHOOK_TIMEOUT_MS),
         });
 
         if (!response.ok) {
@@ -138,7 +191,8 @@ export class NotificationService {
         const response = await fetch(url, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify(payload)
+            body: JSON.stringify(payload),
+            signal: AbortSignal.timeout(WEBHOOK_TIMEOUT_MS),
         });
 
         if (!response.ok) {