feat: show notification source (agent vs SAC) in alerts and reports

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_daily_report_format.py

@@ -4,8 +4,10 @@ from datetime import datetime, timezone
 
 from app.models import Host
 from app.services.daily_report_format import (
+    append_notification_source_plain,
     build_report_body,
     enrich_stats_for_storage,
+    format_notification_source_plain,
     normalize_active_users_list,
     normalize_report_body,
 )
@@ -74,6 +76,28 @@ def test_build_report_body_windows_layout():
     assert len(lines) == 2
 
 
+def test_build_report_body_includes_notification_source():
+    host = Host(hostname="h1", display_name="H1", os_family="linux", product="ssh-monitor")
+    when = datetime(2026, 5, 29, 9, 0, 5, tzinfo=timezone.utc)
+    stats = enrich_stats_for_storage("ssh", {"successful_ssh": 0, "failed_ssh": 0, "sudo_commands": 0, "active_bans": 0})
+    sac_body = build_report_body("ssh", host, stats, when, sac_generated=True)
+    assert "📡 Оповещение: SAC (Security Alert Center)" in sac_body
+    agent_body = build_report_body(
+        "ssh",
+        host,
+        {**stats, "agent_version": "1.2.11-SAC"},
+        when,
+        sac_generated=False,
+    )
+    assert "📡 Оповещение: агент (ssh-monitor 1.2.11-SAC)" in agent_body
+
+
+def test_append_notification_source_plain_dedupes():
+    line = format_notification_source_plain(generated_by="sac")
+    body = append_notification_source_plain(f"title\n\n{line}", generated_by="sac")
+    assert body.count("📡 Оповещение:") == 1
+
+
 def test_normalize_active_users_list_splits_combined_line():
     users = normalize_active_users_list(["👤 k.khodasevich 👤 papatramp"])
     assert len(users) == 2