Publish alerts to a Sandbar topic and keep a Sandbar monitor for every resource with health checks

A Sandbar topic channel publishes alerts as ntfy-style messages (API key
optional). Under Server, Settings, Hammerhead can create, update and remove a
Sandbar monitor per enabled resource with health checks, linked by resource id
so monitors made by hand are left alone. The key is sealed at rest.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

db.go

@@ -117,6 +117,7 @@ func (d *DB) sealed(v any) any {
 		return &c
 	case Settings:
 		x.SMTP.Pass = b.Seal(x.SMTP.Pass)
+		x.Sandbar.Token = b.Seal(x.Sandbar.Token)
 		return x
 	}
 	return v
@@ -146,7 +147,7 @@ func (d *DB) unseal(v any) error {
 	case *AlertChannel:
 		return errors.Join(d.open1(&x.Target), d.open1(&x.Token))
 	case *Settings:
-		return d.open1(&x.SMTP.Pass)
+		return errors.Join(d.open1(&x.SMTP.Pass), d.open1(&x.Sandbar.Token))
 	}
 	return nil
 }