fix: resolve email provider test regression from Stage 2 flag registration

After email was recognised as a supported provider type, the existing
rejection assertion for unsupported types incorrectly included email
in its denial list, causing a nil-dereference panic.

- Remove email from the unsupported-type rejection list and cover it
  in the accepted-types path instead
- Correct allFeaturesEnabled fixture to set email flag to true, keeping
  the fixture semantically consistent with all other service flags

backend/internal/models/notification_config.go

@@ -14,10 +14,10 @@ type NotificationConfig struct {
 	MinLogLevel string `json:"min_log_level"` // error, warn, info, debug
 	WebhookURL  string `json:"webhook_url"`
 	// Blocker 2 Fix: API surface uses security_* field names per spec (internal fields remain notify_*)
-	NotifyWAFBlocks         bool `json:"security_waf_enabled"`
-	NotifyACLDenies         bool `json:"security_acl_enabled"`
-	NotifyRateLimitHits     bool `json:"security_rate_limit_enabled"`
-	NotifyCrowdSecDecisions bool `json:"security_crowdsec_enabled"`
+	NotifyWAFBlocks         bool   `json:"security_waf_enabled"`
+	NotifyACLDenies         bool   `json:"security_acl_enabled"`
+	NotifyRateLimitHits     bool   `json:"security_rate_limit_enabled"`
+	NotifyCrowdSecDecisions bool   `json:"security_crowdsec_enabled"`
 
 	// Legacy destination fields (compatibility, not stored in DB)
 	DiscordWebhookURL    string `gorm:"-" json:"discord_webhook_url,omitempty"`

backend/internal/services/notification_service_discord_only_test.go

@@ -22,7 +22,7 @@ func TestDiscordOnly_CreateProviderRejectsUnsupported(t *testing.T) {
 
 	service := NewNotificationService(db)
 
-	testCases := []string{"slack", "telegram", "generic", "email"}
+	testCases := []string{"slack", "telegram", "generic"}
 
 	for _, providerType := range testCases {
 		t.Run(providerType, func(t *testing.T) {
@@ -101,6 +101,24 @@ func TestDiscordOnly_CreateProviderAcceptsGotifyWithOrWithoutToken(t *testing.T)
 	assert.NoError(t, err)
 }
 
+// TestDiscordOnly_CreateProviderAcceptsEmail tests that email is accepted as a supported provider type.
+func TestDiscordOnly_CreateProviderAcceptsEmail(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	require.NoError(t, err)
+	require.NoError(t, db.AutoMigrate(&models.NotificationProvider{}))
+
+	service := NewNotificationService(db)
+
+	provider := &models.NotificationProvider{
+		Name: "Test Email",
+		Type: "email",
+		URL:  "smtp://smtp.example.com",
+	}
+
+	err = service.CreateProvider(provider)
+	assert.NoError(t, err, "Should accept email provider")
+}
+
 // TestDiscordOnly_UpdateProviderRejectsTypeMutation tests immutable provider type on update.
 func TestDiscordOnly_UpdateProviderRejectsTypeMutation(t *testing.T) {
 	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})

tests/fixtures/settings.ts

@@ -292,7 +292,7 @@ export const defaultFeatureFlags: FeatureFlags = {
 export const allFeaturesEnabled: FeatureFlags = {
   cerberus_enabled: true,
   crowdsec_console_enrollment: true,
-  "feature.notifications.service.email.enabled": false,
+  "feature.notifications.service.email.enabled": true,
   uptime_monitoring: true,
 };