feat(api): phase 5 — alerts, agent depth, subdomains, auth, boards

P5b: notifier transport registry (webhook/slack/discord/telegram/
gotify/ntfy/smtp via net/smtp), per-monitor+domain alert rules
(failsBeforeDown, latencyWarn, certDays, mute).

P5c: per-container cpu/mem, optional SMART/ZFS/GPU exec-or-skip
collectors, crt.sh subdomain discovery with daily sweep.

P5d: opt-in auth (bcrypt, sqlite sessions, 7d rotating cookie, login
rate limit, public-route bypass) and multiple boards (boards table,
sections.board_id, /api/boards CRUD, slug routing).

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/db/migrations/0007_alerts.sql

@@ -0,0 +1,10 @@
+-- +goose Up
+-- Per-target alert rules as a JSON blob: {consecutiveFailures, latencyWarnMs,
+-- certDays, mute}. '{}' = defaults (alert on first failure, no latency rule,
+-- cert threshold = alert_days_before, unmuted).
+ALTER TABLE monitors ADD COLUMN alerts JSON NOT NULL DEFAULT '{}';
+ALTER TABLE domains  ADD COLUMN alerts JSON NOT NULL DEFAULT '{}';
+
+-- +goose Down
+ALTER TABLE monitors DROP COLUMN alerts;
+ALTER TABLE domains  DROP COLUMN alerts;

apps/backend/internal/db/migrations/0008_subdomains.sql

@@ -0,0 +1,18 @@
+-- +goose Up
+CREATE TABLE subdomains (
+    id         TEXT PRIMARY KEY,
+    domain_id  TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    name       TEXT NOT NULL,
+    ips        JSON NOT NULL DEFAULT '[]',
+    first_seen TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+    last_seen  TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+    UNIQUE(domain_id, name)
+);
+CREATE INDEX subdomains_domain_idx ON subdomains(domain_id);
+
+-- Discovery runs at most once per day per domain, inside the domain sweep.
+ALTER TABLE domains ADD COLUMN sub_checked_at TEXT;
+
+-- +goose Down
+ALTER TABLE domains DROP COLUMN sub_checked_at;
+DROP TABLE IF EXISTS subdomains;

apps/backend/internal/db/migrations/0009_auth.sql

@@ -0,0 +1,22 @@
+-- +goose Up
+-- Opt-in local auth. Empty users table = setup mode; auth_enabled settings
+-- key gates the middleware. Sessions live in SQLite — restart-safe, and a
+-- `dash-agent`-style bearer token path is unaffected.
+CREATE TABLE users (
+    id         TEXT PRIMARY KEY,
+    username   TEXT NOT NULL UNIQUE,
+    pass_hash  TEXT NOT NULL,
+    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+);
+
+CREATE TABLE sessions (
+    token      TEXT PRIMARY KEY,
+    user_id    TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+    expires_at TEXT NOT NULL
+);
+CREATE INDEX sessions_expiry_idx ON sessions(expires_at);
+
+-- +goose Down
+DROP TABLE IF EXISTS sessions;
+DROP TABLE IF EXISTS users;

apps/backend/internal/db/migrations/0010_boards.sql

@@ -0,0 +1,32 @@
+-- +goose Up
+-- Multiple boards. Every section belongs to exactly one board; the seeded
+-- 'home' board adopts existing rows. NULL board_id maps to 'home' at read
+-- time so old imports/exports keep working without a backfill.
+CREATE TABLE boards (
+    id         TEXT PRIMARY KEY,
+    slug       TEXT NOT NULL UNIQUE,
+    name       TEXT NOT NULL,
+    position   REAL NOT NULL,
+    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+);
+INSERT INTO boards (id, slug, name, position) VALUES ('b_home', 'home', 'Home', 1024);
+
+ALTER TABLE sections ADD COLUMN board_id TEXT REFERENCES boards(id) ON DELETE CASCADE;
+UPDATE sections SET board_id = 'b_home';
+CREATE INDEX sections_board_pos ON sections(board_id, position);
+
+-- +goose Down
+DROP INDEX IF EXISTS sections_board_pos;
+-- SQLite can't drop columns pre-3.35; rebuild instead.
+CREATE TABLE sections_new (
+    id         TEXT PRIMARY KEY,
+    name       TEXT NOT NULL,
+    position   REAL NOT NULL,
+    collapsed  INTEGER NOT NULL DEFAULT 0,
+    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+);
+INSERT INTO sections_new (id, name, position, collapsed, created_at)
+    SELECT id, name, position, collapsed, created_at FROM sections;
+DROP TABLE sections;
+ALTER TABLE sections_new RENAME TO sections;
+DROP TABLE boards;