Publish alerts to a Sandbar topic and keep a Sandbar monitor for every resource with health checks

A Sandbar topic channel publishes alerts as ntfy-style messages (API key
optional). Under Server, Settings, Hammerhead can create, update and remove a
Sandbar monitor per enabled resource with health checks, linked by resource id
so monitors made by hand are left alone. The key is sealed at rest.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

settings.go

@@ -16,8 +16,9 @@ func (s *Server) getSettings(w http.ResponseWriter, r *http.Request, p *principa
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	st := s.st.Settings
-	st.SMTP.Pass = "" // write-only
-	writeJSON(w, 200, map[string]any{"settings": st, "smtpPassSet": s.st.Settings.SMTP.Pass != ""})
+	st.SMTP.Pass = ""                               // write-only
+	st.Sandbar.Token, st.Sandbar.Monitors = "", nil // write-only
+	writeJSON(w, 200, map[string]any{"settings": st, "smtpPassSet": s.st.Settings.SMTP.Pass != "", "sandbarTokenSet": s.st.Settings.Sandbar.Token != "", "sandbarSync": s.sandbarStatus})
 }
 
 func (s *Server) putSettings(w http.ResponseWriter, r *http.Request, p *principal) {
@@ -38,6 +39,11 @@ func (s *Server) putSettings(w http.ResponseWriter, r *http.Request, p *principa
 	if in.SMTP.Pass == "" {
 		in.SMTP.Pass = s.st.Settings.SMTP.Pass // blank keeps the saved password
 	}
+	if err := s.cleanSandbar(&in.Sandbar); err != nil {
+		s.mu.Unlock()
+		fail(w, 400, err)
+		return
+	}
 	if s.opts.DashboardURL != "" {
 		in.DashboardURL = s.st.Settings.DashboardURL // pinned by flag/env
 	}