feat: add notification suppression rules (#1525)

* feat: add notification suppression rules

* fix: restore label routing and routing test mocks for suppression

* fix: allow bell mute shortcuts for history-only notification categories

Suppression rule validation used the routable category whitelist, which rejected history-only categories such as update_started that appear in the bell during stack updates.

* feat: expand Mute Rules UX with compose-first entry points and activity badges

* fix: add missing NodeContext mocks for notification suppression tests

docs/features/alerts-notifications.mdx

@@ -101,6 +101,36 @@ Three icon actions appear on the right edge of each card:
 
 The masthead carries `SCOPE` (`global`), `ROUTES` (total), and `ENABLED` (count).
 
+## Mute Rules
+
+<Note>
+  Admin role is required to create, edit, or delete mute rules.
+</Note>
+
+Notification suppression rules **hide or drop** matching alerts. They do not send alerts elsewhere. Routing and suppression are separate: a rule can match the same alert as a route, but suppression is evaluated first and can block bell delivery, external channels, or both.
+
+Open **Settings · Notifications · Mute Rules** and click **+ Add mute rule**.
+
+| Field | Purpose |
+|-------|---------|
+| **Name** | A human label, up to 100 characters. |
+| **Node scope** | `Any node` or a specific fleet node. Limits which node emits the alert before the rule can match. |
+| **Stacks** *(optional)* | Stack names. Empty matches any stack. |
+| **Labels** *(optional)* | Stack labels. Empty matches any label. |
+| **Categories** *(optional)* | Notification categories. Empty matches any category. |
+| **Severity** *(optional)* | One or more of info, warning, or error. Empty matches any severity. |
+| **Apply to** | **Bell**, **External**, or **Both**. Bell skips the notification popover WebSocket push. External skips routing rules and global channels. |
+| **Expiration** | Forever, 1 hour, 24 hours, or a custom date. Expired rules stop matching automatically. |
+| **Enabled** | Toggle the rule without deleting it. |
+
+All non-empty matchers must match (AND). Suppressed alerts are still written to stack activity history; only delivery is affected. When a mute rule blocks delivery, the activity row shows a **Suppressed** badge with the matched rule name in a tooltip.
+
+Rules you create on the control instance replicate to remote nodes so alerts emitted on a remote stack honor the same suppression. From the bell, admins can open a row menu and choose **Mute this category**, **Mute notifications like this**, or **Mute this stack** to create a quick rule with default **Both** targeting. The same presets are available from stack menus (sidebar, stack header, activity tab), fleet node cards, and label groups.
+
+### Built-in bell quieting (not a mute rule)
+
+Sencho also hides one class of notification from the popover without a user rule: rows where the category is one of `deploy_success`, `stack_started`, `stack_stopped`, `stack_restarted`, or `image_update_applied`, and the row carries an `actor_username` other than `system`. These are confirmations of an action you just clicked. The rows are still persisted and still dispatched externally; only the bell render hides them. Use mute rules when you need configurable, operator-controlled muting.
+
 ## Notification categories
 
 Every alert Sencho dispatches carries a category that you can filter on in the bell, target with a routing rule's **Categories** matcher, or reason about when reading audit history.

docs/reference/settings.mdx

@@ -419,6 +419,32 @@ See [Notification Routing](/features/alerts-notifications#notification-routing)
 
 ---
 
+## Mute Rules
+
+<Note>
+  Creating, editing, and deleting mute rules is admin-only.
+</Note>
+
+**Scope:** Global, admin-only
+
+Create notification suppression rules that mute or drop matching alerts from the bell, external channels, or both. Suppression is evaluated before routing. The masthead publishes **RULES** and **ACTIVE** counts.
+
+| Field | Description |
+|-------|-------------|
+| **Name** | Operator-facing label for the rule. |
+| **Node** | Specific node, or all nodes if left empty. |
+| **Stack patterns** | Stack names to match (multi-select). |
+| **Labels** | Match stacks that carry any selected label. |
+| **Categories** | Notification categories to suppress. |
+| **Severity** | Info, warning, and/or error levels to suppress. |
+| **Apply to** | Bell only, external channels only, or both. |
+| **Expiration** | Forever, 1 hour, 24 hours, or a custom timestamp. |
+| **Enabled** toggle | Disable a rule without deleting it. |
+
+See [Mute Rules](/features/alerts-notifications#mute-rules) for the full walkthrough, compose-first shortcuts, and bell quick-mute.
+
+---
+
 ## Image update checks
 
 **Scope:** Per-node (applies to the currently selected node)