Merge PR #128: harden notification settings

Harden notification settings for Milestone 6.

docs/deployment/configuration.md

@@ -80,12 +80,14 @@ For database operations, use the [Database Backup and Restore](backups.md) guide
 DMARQ stores notification targets in the web settings table. Configure them under
 **Settings** > **Notifications** and use newline-separated Apprise URLs, such as
 email, Slack, Teams, Discord, or webhook targets. Saved target URLs are redacted
-from API responses.
+from API responses and encrypted at rest with the application `SECRET_KEY`.
 
 | Setting | Description | Default | Example |
 |---------|-------------|---------|---------|
 | `notifications.apprise_enabled` | Enable Apprise notification delivery | `false` | `true` |
 | `notifications.apprise_urls` | Newline-separated Apprise target URLs | - | `mailto://user:pass@example.com` |
+| `notifications.min_send_interval_minutes` | Minimum minutes between outbound notification deliveries | `15` | `30` |
+| `notifications.redact_pii_enabled` | Redact email addresses from outbound notification text | `true` | `true` |
 | `notifications.alert_new_sources_enabled` | Alert on newly observed sending sources | `true` | `true` |
 | `notifications.alert_compliance_drop_enabled` | Alert on recent compliance-rate drops | `true` | `true` |
 | `notifications.alert_compliance_drop_points` | Minimum compliance-rate drop in percentage points | `10` | `15` |
@@ -98,9 +100,11 @@ from API responses.
 | `notifications.summary_send_hour_utc` | UTC hour for scheduled summaries | `8` | `7` |
 | `notifications.summary_weekday_utc` | UTC weekday for weekly summaries, where 0 is Monday | `0` | `4` |
 
-Alert history is stored in the database-backed `alert_history` table. Current
-retention is indefinite; prune old resolved rows according to your operational
-policy if long-term storage size matters.
+Alert history is stored in the database-backed `alert_history` table.
+Notification and alert-rule configuration changes are stored in
+`alert_configuration_audit` with secret values sanitized. Current retention is
+indefinite; prune old resolved history and audit rows according to your
+operational policy if long-term storage size matters.
 
 ### Cloudflare Integration
 

docs/milestones.md

@@ -113,11 +113,12 @@ Goal: notify administrators when action is needed.
 
 Delivered:
 - Apprise notification integration for newline-separated notification target URLs.
-- Notification settings UI can save Apprise targets, keeps target URLs redacted after save, and can send a test notification.
+- Notification settings UI can save Apprise targets, stores target URLs encrypted, keeps target URLs redacted after save, and can send a test notification.
 - Alert rules for new sender source, compliance drop, DMARC failures above threshold, and missing reports.
 - Notification settings UI can evaluate active alerts and send the current alert summary on demand.
 - Daily and weekly DMARC summary notifications, including scheduled delivery and manual preview/send controls.
 - Alert history records active and resolved alerts with first-seen, last-seen, observed-count, and payload metadata.
+- Outbound notifications are rate-limited, email addresses are redacted by default, and notification configuration changes are audited without raw secrets.
 
 Exit criteria:
 - A user can receive meaningful alerts without opening the dashboard daily.

docs/user_guide/settings.md

@@ -39,8 +39,13 @@ Configure where DMARQ sends notifications:
 4. Add one Apprise target URL per line.
 5. Save and use **Send Test** to verify delivery.
 
-Target URLs are redacted after saving so credentials are not exposed through the
-settings API or page reloads.
+Target URLs are encrypted in the database and redacted after saving so
+credentials are not exposed through the settings API or page reloads.
+
+The notification page also includes a minimum send interval. This cooldown
+limits repeated outbound notifications if several alert checks run close
+together. Email addresses in notification titles and bodies are redacted by
+default before messages are sent.
 
 ### Alert Thresholds
 
@@ -69,6 +74,12 @@ Alert history appears in **Settings** > **Notifications** after alerts have been
 evaluated or sent. Each row shows whether the alert is active or resolved, how
 many times it has been observed, and the latest alert detail.
 
+### Configuration Audit
+
+Notification and alert-rule setting changes appear in **Settings** >
+**Notifications**. Secret values are shown only as redacted markers in this
+audit trail.
+
 ### Integration Notifications
 
 Apprise supports email, Slack, Teams, Discord, generic webhooks, and many other