NotificationChannel model & CRUD

[richardmhope]

NotificationChannel model + CRUD for email and webhook channels with an event filter.

Acceptance: channels CRUD with RBAC; filter config (min severity, source scope) validated.

Parent: #14

[richardmhope]

Delivered in #96 (M3), not M4 — the channels screen needed routes to drive, so the model and its CRUD shipped alongside it. docs/backlog.md records the move.

Against the acceptance criteria:

• Channels CRUD with RBAC — apps/api/src/iceberg_api/notifications/routes.py, admin-only on every route, audit-logged because a webhook channel is a deliberate egress path.
• Filter config validated — EventFilter (min_severity, source_ids) plus per-type config validation (WebhookConfig/EmailConfig, extra="forbid") in notifications/schemas.py. Channel secrets are sealed through the secret store and never returned; has_secret is the exposed contract.
• Covered by apps/api/tests/test_notifications.py.

Dispatch remains open as #60.