feat: SMTP email notification channel with UI and ingest

Migration 006, email config DB/env, smtplib sender, settings API,
Settings UI section, and dispatch on event/problem ingest.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_email_notify.py

@@ -0,0 +1,71 @@
+"""Tests for SAC email notification helpers."""
+
+from datetime import datetime, timezone
+from unittest.mock import patch
+
+from app.models import Event
+from app.services import email_notify
+from app.services.notification_settings import EmailConfig
+
+
+def test_notify_event_respects_min_severity():
+    sent: list[tuple[str, str]] = []
+
+    def fake_send(subject: str, body: str, **kwargs) -> None:
+        sent.append((subject, body))
+
+    event = Event(
+        event_id="00000000-0000-4000-8000-000000000301",
+        host_id=1,
+        occurred_at=datetime(2026, 5, 29, 14, 0, tzinfo=timezone.utc),
+        category="auth",
+        type="rdp.login.failed",
+        severity="warning",
+        title="failed",
+        summary="smtp test",
+        payload={},
+    )
+
+    cfg = EmailConfig(
+        enabled=True,
+        smtp_host="smtp.example.com",
+        smtp_port=587,
+        smtp_user="u",
+        smtp_password="p",
+        mail_from="sac@example.com",
+        mail_to="admin@example.com",
+        smtp_starttls=True,
+        smtp_ssl=False,
+        min_severity="high",
+        source="env",
+    )
+    with patch.object(email_notify, "get_effective_email_config", return_value=cfg):
+        with patch.object(email_notify, "send_email_message", side_effect=fake_send):
+            email_notify.notify_event(event)
+    assert sent == []
+
+    cfg_warn = EmailConfig(
+        enabled=True,
+        smtp_host="smtp.example.com",
+        smtp_port=587,
+        smtp_user="",
+        smtp_password="",
+        mail_from="sac@example.com",
+        mail_to="admin@example.com",
+        smtp_starttls=True,
+        smtp_ssl=False,
+        min_severity="warning",
+        source="env",
+    )
+    with patch.object(email_notify, "get_effective_email_config", return_value=cfg_warn):
+        with patch.object(email_notify, "send_email_message", side_effect=fake_send):
+            email_notify.notify_event(event)
+    assert len(sent) == 1
+
+
+def test_parse_mail_recipients():
+    assert email_notify.parse_mail_recipients("a@x.com; b@x.com, c@x.com") == [
+        "a@x.com",
+        "b@x.com",
+        "c@x.com",
+    ]