feat: webhook alerts for monitor + domain events (merge plan M2)

Generic webhook notification delivery configured via the
notify_webhook settings key — no new schema. Fires on monitor
up/down transitions (pending stays silent), domain expiry,
domain expiring, and TLS cert expiring; dispatch is async and
failures are logged, never fatal.

POST /api/notify/test verifies configuration; Settings dialog
gains a webhook URL field with save + send-test. Payload carries
event/name/text/content/message so Slack, Discord, ntfy, and
custom receivers all work.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/api/monitors.go

@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"net/http"
 	"strconv"
 	"time"
@@ -491,10 +492,17 @@ func (s *Server) writeHeartbeat(m *monitor.Monitor, res *monitor.Result) {
 	}
 }
 
-// onMonitorTransition is the alert seam — M2 wires notifications here.
+// onMonitorTransition fires on real state flips (pending excluded upstream)
+// — the notification seam for up/down events.
 func (s *Server) onMonitorTransition(m *monitor.Monitor, prev, next string) {
 	s.log.Info("monitor transition",
 		zap.String("monitor", m.Name), zap.String("from", prev), zap.String("to", next))
+	target := m.URL
+	if target == "" {
+		target = m.Hostname
+	}
+	s.notify("monitor."+next, m.Name,
+		fmt.Sprintf("Monitor %q is %s (%s)", m.Name, next, target))
 }
 
 func truncate(s string, n int) string {