feat: add notification alert rules

docs/deployment/configuration.md

@@ -85,6 +85,13 @@ from API responses.
 |---------|-------------|---------|---------|
 | `notifications.apprise_enabled` | Enable Apprise notification delivery | `false` | `true` |
 | `notifications.apprise_urls` | Newline-separated Apprise target URLs | - | `mailto://user:pass@example.com` |
+| `notifications.alert_new_sources_enabled` | Alert on newly observed sending sources | `true` | `true` |
+| `notifications.alert_compliance_drop_enabled` | Alert on recent compliance-rate drops | `true` | `true` |
+| `notifications.alert_compliance_drop_points` | Minimum compliance-rate drop in percentage points | `10` | `15` |
+| `notifications.alert_failure_threshold_enabled` | Alert on high recent DMARC failure volume | `true` | `true` |
+| `notifications.alert_failure_threshold_count` | Failed messages in the last day before alerting | `100` | `250` |
+| `notifications.alert_missing_reports_enabled` | Alert when a monitored domain stops receiving reports | `true` | `true` |
+| `notifications.alert_missing_reports_days` | Days without reports before alerting | `2` | `3` |
 
 ### Cloudflare Integration
 

docs/development/roadmap.md

@@ -83,7 +83,7 @@ Follow-up:
 
 ## Later Milestones
 
-- Notifications and alert rules. Apprise delivery and test notifications are in place; alert rules, summaries, and alert history remain.
+- Notifications and alert rules. Apprise delivery, test notifications, and current alert-rule evaluation are in place; scheduled summaries and alert history remain.
 - DNS health and Cloudflare read-only inspection.
 - Guided setup and operator health screens.
 - Forensic/RUF report support.

docs/milestones.md

@@ -114,9 +114,10 @@ Goal: notify administrators when action is needed.
 Delivered:
 - Apprise notification integration for newline-separated notification target URLs.
 - Notification settings UI can save Apprise targets, keeps target URLs redacted after save, and can send a test notification.
+- Alert rules for new sender source, compliance drop, DMARC failures above threshold, and missing reports.
+- Notification settings UI can evaluate active alerts and send the current alert summary on demand.
 
 Planned:
-- Alert rules for new sender source, compliance drop, DMARC failures above threshold, and missing reports.
 - Daily/weekly summary notifications.
 - Alert history.
 

docs/todo.md

@@ -165,7 +165,7 @@ Status: Complete for the delivered reporting milestone. Alert-specific dashboard
 - [x] Add backup/restore guidance for database deployments
 - [x] Add release checklist covering migrations, tests, and smoke checks
 - [x] Add Apprise notification delivery and test notification support
-- [ ] Add alert rules for new sender source, compliance drop, DMARC failures above threshold, and missing reports
+- [x] Add alert rules for new sender source, compliance drop, DMARC failures above threshold, and missing reports
 - [ ] Add daily and weekly summary notifications
 - [ ] Add alert history
 - [ ] DNS health guidance and Cloudflare read-only inspection

docs/user_guide/settings.md

@@ -44,14 +44,15 @@ settings API or page reloads.
 
 ### Alert Thresholds
 
-Set thresholds for when alerts are triggered:
+Set alert rules and thresholds in **Settings** > **Notifications**:
 
-1. Navigate to **Settings** > **Notifications** > **Thresholds**
-2. Configure thresholds for:
-   - **Compliance Rate Drop**: Alert when compliance falls below a threshold
-   - **New Sending Sources**: Alert when new IPs/servers send email as your domain
-   - **Authentication Failures**: Alert when failures exceed a certain number
-   - **Report Processing Issues**: Alert on report processing errors
+- **New Sending Sources**: newly observed IPs or servers sending as a monitored domain
+- **Compliance Drops**: recent compliance-rate drops beyond the configured point threshold
+- **High DMARC Failures**: failed messages over the daily threshold
+- **Missing Reports**: monitored domains without reports for the configured number of days
+
+Use **Check Alerts** to preview the current alert count, or **Send Alerts Now** to
+send the current alert summary through the configured Apprise targets.
 
 ### Integration Notifications