feat: add notification channels with provider integrations and retry

Implement a channels system for notifying teams via external providers
(Discord, Slack, Teams, Google Chat, Telegram, Matrix, webhook) when
lifecycle events occur (capsule/template/host state changes).

- Channel CRUD API under /v1/channels (JWT-only auth)
- Test endpoint to verify config before saving (POST /v1/channels/test)
- Secret rotation endpoint (PUT /v1/channels/{id}/config)
- AES-256-GCM encryption for provider secrets (WRENN_ENCRYPTION_KEY)
- Redis stream event publishing from audit logger
- Background dispatcher with consumer group and retry (10s, 30s)
- Webhook delivery with HMAC-SHA256 signing (X-WRENN-SIGNATURE)
- shoutrrr integration for chat providers
- Secrets never exposed in API responses

internal/channels/message.go

@@ -0,0 +1,31 @@
+package channels
+
+import (
+	"fmt"
+
+	"git.omukk.dev/wrenn/sandbox/internal/events"
+)
+
+// FormatMessage produces a compact notification string for chat providers.
+func FormatMessage(e events.Event) string {
+	switch e.Event {
+	case events.CapsuleCreated:
+		return fmt.Sprintf("[%s] Capsule %s created", e.Event, e.Resource.ID)
+	case events.CapsuleRunning:
+		return fmt.Sprintf("[%s] Capsule %s is running", e.Event, e.Resource.ID)
+	case events.CapsulePaused:
+		return fmt.Sprintf("[%s] Capsule %s paused", e.Event, e.Resource.ID)
+	case events.CapsuleDestroyed:
+		return fmt.Sprintf("[%s] Capsule %s destroyed", e.Event, e.Resource.ID)
+	case events.SnapshotCreated:
+		return fmt.Sprintf("[%s] Template snapshot %s created", e.Event, e.Resource.ID)
+	case events.SnapshotDeleted:
+		return fmt.Sprintf("[%s] Template snapshot %s deleted", e.Event, e.Resource.ID)
+	case events.HostUp:
+		return fmt.Sprintf("[%s] Host %s is up", e.Event, e.Resource.ID)
+	case events.HostDown:
+		return fmt.Sprintf("[%s] Host %s is down", e.Event, e.Resource.ID)
+	default:
+		return fmt.Sprintf("[%s] %s %s", e.Event, e.Resource.Type, e.Resource.ID)
+	}
+}