chore: enable Gotify and Custom Webhhok notifications and improve payload validation

- Enhanced Notifications component tests to include support for Discord, Gotify, and Webhook provider types.
- Updated test cases to validate the correct handling of provider type options and ensure proper payload structure during creation, preview, and testing.
- Introduced new tests for Gotify token handling and ensured sensitive information is not exposed in the UI.
- Refactored existing tests for clarity and maintainability, including improved assertions and error handling.
- Added comprehensive coverage for payload validation scenarios, including malformed requests and security checks against SSRF and oversized payloads.

frontend/src/api/notifications.test.ts

@@ -88,14 +88,38 @@ describe('notifications api', () => {
     expect(mockedClient.delete).toHaveBeenCalledWith('/notifications/providers/new')
   })
 
-  it('rejects non-discord type before submit for provider mutations and preview', async () => {
-    await expect(createProvider({ name: 'Bad', type: 'slack' })).rejects.toThrow('Only discord notification providers are supported')
-    await expect(updateProvider('bad', { type: 'generic' })).rejects.toThrow('Only discord notification providers are supported')
-    await expect(testProvider({ id: 'bad', type: 'email' })).rejects.toThrow('Only discord notification providers are supported')
-    await expect(previewProvider({ id: 'bad', type: 'gotify' })).rejects.toThrow('Only discord notification providers are supported')
+  it('supports discord, gotify, and webhook while enforcing token payload contract', async () => {
+    mockedClient.post.mockResolvedValue({ data: { id: 'ok' } })
+    mockedClient.put.mockResolvedValue({ data: { id: 'ok' } })
 
-    expect(mockedClient.post).not.toHaveBeenCalled()
-    expect(mockedClient.put).not.toHaveBeenCalled()
+    await createProvider({ name: 'Gotify', type: 'gotify', gotify_token: 'secret-token' })
+    expect(mockedClient.post).toHaveBeenCalledWith('/notifications/providers', {
+      name: 'Gotify',
+      type: 'gotify',
+      token: 'secret-token',
+    })
+
+    await updateProvider('ok', { type: 'webhook', url: 'https://example.com/webhook', gotify_token: 'should-not-send' })
+    expect(mockedClient.put).toHaveBeenCalledWith('/notifications/providers/ok', {
+      type: 'webhook',
+      url: 'https://example.com/webhook',
+    })
+
+    await testProvider({ id: 'ok', type: 'gotify', gotify_token: 'should-not-send' })
+    expect(mockedClient.post).toHaveBeenCalledWith('/notifications/providers/test', {
+      id: 'ok',
+      type: 'gotify',
+    })
+
+    await previewProvider({ id: 'ok', type: 'gotify', gotify_token: 'should-not-send' })
+    expect(mockedClient.post).toHaveBeenCalledWith('/notifications/providers/preview', {
+      id: 'ok',
+      type: 'gotify',
+    })
+
+    await expect(createProvider({ name: 'Bad', type: 'slack' })).rejects.toThrow('Unsupported notification provider type: slack')
+    await expect(updateProvider('bad', { type: 'generic' })).rejects.toThrow('Unsupported notification provider type: generic')
+    await expect(testProvider({ id: 'bad', type: 'email' })).rejects.toThrow('Unsupported notification provider type: email')
   })
 
   it('fetches templates and previews provider payloads with data', async () => {