Publish alerts to a Sandbar topic and keep a Sandbar monitor for every resource with health checks

A Sandbar topic channel publishes alerts as ntfy-style messages (API key
optional). Under Server, Settings, Hammerhead can create, update and remove a
Sandbar monitor per enabled resource with health checks, linked by resource id
so monitors made by hand are left alone. The key is sealed at rest.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

store.go

@@ -109,10 +109,11 @@ type SMTP struct {
 }
 
 type Settings struct {
-	DashboardURL string `json:"dashboardUrl"`
-	AcmeEmail    string `json:"acmeEmail"`
-	AcmeStaging  bool   `json:"acmeStaging"`
-	SMTP         SMTP   `json:"smtp"`
+	DashboardURL string      `json:"dashboardUrl"`
+	AcmeEmail    string      `json:"acmeEmail"`
+	AcmeStaging  bool        `json:"acmeStaging"`
+	SMTP         SMTP        `json:"smtp"`
+	Sandbar      SandbarSync `json:"sandbar"`
 	// SelfEdgeID is this server's own edge (see HAMMERHEAD_SELF_DOMAIN).
 	SelfEdgeID string `json:"selfEdgeId,omitempty"`
 }
@@ -218,6 +219,9 @@ type Server struct {
 	verAt    time.Time
 	mtaSent  map[string]time.Time // reminder throttle for repeat notifications
 
+	sandbarMu     sync.Mutex        // one monitor sync at a time (see sandbar.go)
+	sandbarStatus sandbarSyncStatus // how the last one went
+
 	logs *logStore
 	db   *DB
 	stop chan struct{}
@@ -299,6 +303,7 @@ func New(dir string, opts Options) (*Server, error) {
 	s.loadAlerts()
 	go s.housekeeping()
 	go s.alertLoop()
+	go s.sandbarLoop()
 	return s, nil
 }