fix(security): address notification system security audit findings

- SSRF: guard sendWebhook() with checkSsrf() + createPinnedAgent() to block
  requests to loopback, link-local, private network, and cloud metadata endpoints
- XSS: escape subject, body, and ctaHref in buildEmailHtml() via escapeHtml()
  to prevent HTML injection through user-controlled params (actor, preview, etc.)
- Encrypt webhook URLs at rest: apply maybe_encrypt_api_key on save
  (settingsService for user URLs, authService for admin URL) and decrypt_api_key
  on read in getUserWebhookUrl() / getAdminWebhookUrl()
- Log failed channel dispatches: inspect Promise.allSettled() results and log
  rejections via logError instead of silently dropping them
- Log admin webhook failures: replace fire-and-forget .catch(() => {}) with
  .catch(err => logError(...)) and await the call
- Migration 69: guard against missing notification_preferences table on fresh installs
- Migration 70: drop the now-unused notification_preferences table
- Refactor: extract applyUserChannelPrefs() helper to deduplicate
  setPreferences / setAdminPreferences logic
- Tests: add SEC-016 (XSS, 5 cases) and SEC-017 (SSRF, 6 cases) test suites;
  mock ssrfGuard in notificationService tests

server/src/services/settingsService.ts

@@ -1,4 +1,7 @@
 import { db } from '../db/database';
+import { maybe_encrypt_api_key } from './apiKeyCrypto';
+
+const ENCRYPTED_SETTING_KEYS = new Set(['webhook_url']);
 
 export function getUserSettings(userId: number): Record<string, unknown> {
   const rows = db.prepare('SELECT key, value FROM settings WHERE user_id = ?').all(userId) as { key: string; value: string }[];
@@ -13,12 +16,17 @@ export function getUserSettings(userId: number): Record<string, unknown> {
   return settings;
 }
 
+function serializeValue(key: string, value: unknown): string {
+  const raw = typeof value === 'object' ? JSON.stringify(value) : String(value !== undefined ? value : '');
+  if (ENCRYPTED_SETTING_KEYS.has(key)) return maybe_encrypt_api_key(raw) ?? raw;
+  return raw;
+}
+
 export function upsertSetting(userId: number, key: string, value: unknown) {
-  const serialized = typeof value === 'object' ? JSON.stringify(value) : String(value !== undefined ? value : '');
   db.prepare(`
     INSERT INTO settings (user_id, key, value) VALUES (?, ?, ?)
     ON CONFLICT(user_id, key) DO UPDATE SET value = excluded.value
-  `).run(userId, key, serialized);
+  `).run(userId, key, serializeValue(key, value));
 }
 
 export function bulkUpsertSettings(userId: number, settings: Record<string, unknown>) {
@@ -29,8 +37,7 @@ export function bulkUpsertSettings(userId: number, settings: Record<string, unkn
   db.exec('BEGIN');
   try {
     for (const [key, value] of Object.entries(settings)) {
-      const serialized = typeof value === 'object' ? JSON.stringify(value) : String(value !== undefined ? value : '');
-      upsert.run(userId, key, serialized);
+      upsert.run(userId, key, serializeValue(key, value));
     }
     db.exec('COMMIT');
   } catch (err) {