feat(api): phase 5 — alerts, agent depth, subdomains, auth, boards

P5b: notifier transport registry (webhook/slack/discord/telegram/
gotify/ntfy/smtp via net/smtp), per-monitor+domain alert rules
(failsBeforeDown, latencyWarn, certDays, mute).

P5c: per-container cpu/mem, optional SMART/ZFS/GPU exec-or-skip
collectors, crt.sh subdomain discovery with daily sweep.

P5d: opt-in auth (bcrypt, sqlite sessions, 7d rotating cookie, login
rate limit, public-route bypass) and multiple boards (boards table,
sections.board_id, /api/boards CRUD, slug routing).

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/widget/embed.go

@@ -0,0 +1,30 @@
+package widget
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+)
+
+// Embed renders a sandboxed iframe client-side — registered only so
+// /api/widgets/types lists it. The browser fetches the framed page, not the
+// server (remote content may be LAN-only or need the user's cookies).
+type embed struct{}
+
+func init() { Register(embed{}) }
+
+func (embed) Meta() Type {
+	return Type{
+		Type:        "embed",
+		Name:        "Embed",
+		Description: "Embed any page in a tile",
+		Local:       true,
+		Fields: []Field{
+			{Key: "url", Label: "URL", Placeholder: "https://…", Required: true},
+		},
+	}
+}
+
+func (embed) Fetch(context.Context, json.RawMessage) (any, error) {
+	return nil, fmt.Errorf("embed renders client-side")
+}