Add hardened outbound alert notifications

[Adam-Ghanem]

Summary

• add generic webhook and optional Slack outbound alert notifications
• notify on newly created alerts at the configured severity threshold and on SLA breach transitions
• keep payloads de-identified by default, with raw targets behind an explicit opt-in flag
• add admin-only notification status and synthetic test endpoints
• add debounce, bounded background delivery, retry/backoff, response caps, and a circuit breaker

Security posture

• disabled unless an outbound channel is explicitly configured
• HTTPS-only URLs with no credentials, query, or fragment
• redirects are never followed
• five-second request timeout and bounded retries
• endpoint URLs and response bodies are never logged or returned
• notification failures never fail or roll back alert creation

Validation

• 183 tests passed
• flake8, mypy, Bandit, Black, isort, and git diff --check passed
• no scanning, port-audit, or README changes