Add appointment notification preview flow and configurable email/SMS demo recipients

[MaraCode89]

This update adds appointment notification preview support across the CareConnect backend and frontend, while also expanding environment configuration for email, SMS, and API integrations.

What changed

Environment configuration

Added new environment variables for:

• SendGrid API key
• default sender email address
• demo email recipient for notification testing
• demo phone recipient for notification testing
• DeepSeek API key
• OpenAI API key
• S3 bucket name

Backend updates

• Added a new POST /patient/{patientId}/preview-notification endpoint in TaskController
• Expanded TaskService to:
  • send appointment notifications automatically when an appointment task is created
  • generate notification preview content without sending
  • resolve patient or demo fallback email/phone recipients
• Refactored SES appointment email methods into reusable builders for:
  • subject
  • HTML body
  • text body
• Refactored SNS appointment SMS generation into a reusable builder method

Frontend updates

• Added previewTaskNotification() to ApiService
• Updated the calendar assistant flow to:
  • create tasks through the active task API method
  • request a notification preview after creating appointment tasks
  • display an appointment notification preview dialog showing:
    • email recipient
    • email subject
    • email body
    • SMS recipient
    • SMS body

Why this matters

This change improves visibility into the notification system by allowing users and developers to preview appointment reminders before relying on live delivery. It also makes testing easier by supporting configurable demo recipients and cleaner reusable notification templates.

[github-actions]

CareConnect Quality Gate Report

BLOCKED — One or more required checks failed. Fix the issues below before merging.

CareConnect — Security & Quality Analysis Report

Report Header

Field	Value
Generated (UTC)	2026-03-28 05:59:59 UTC
Pipeline Run	#623
Trigger	pull_request
Scan Root	.

All timestamps are reported in Coordinated Universal Time (UTC).

Pull Request

Field	Value
PR Number	#328
PR Author	@MaraCode89
Source Branch	team_d-Matt-Notification
Target Branch	team_d

Commit Details

Field	Value
Commit SHA	4039f9c (full)

Legend

Status	Meaning
SUCCESS	Tool ran and found no violations
FAILURE	Tool found one or more violations
DISABLED	Tool is not yet configured
Enforced	Violations from this tool will block the merge
Advisory	Violations are reported but will not block the merge

Tool Results Summary

Tool	Category	Status	Role	Findings
trufflehog	Secrets Scan	FAILURE	Enforced	44 finding(s)
gitleaks	Secrets Scan	FAILURE	Enforced	20 finding(s)
flutter_analyze	SAST — Flutter	FAILURE	Enforced	1481 finding(s)
checkstyle	SAST — Java	FAILURE	Enforced	29690 finding(s)
pmd	SAST — Java	FAILURE	Enforced	11293 finding(s)
spotbugs	SAST — Java	FAILURE	Enforced	709 finding(s)
semgrep	SAST — Multi	FAILURE	Enforced	53 finding(s)
pylint	SAST — Python	FAILURE	Enforced	180 finding(s)
bandit	SAST — Python	FAILURE	Enforced	39 finding(s)
htmlhint	SAST — Web	FAILURE	Enforced	623 finding(s)
stylelint	SAST — Web	FAILURE	Enforced	15 finding(s)
dependency_check	SCA — Multi	SUCCESS	Enforced	—
trivy	SCA — Container	FAILURE	Enforced	39 finding(s)

---

Full artifact bundle available in the workflow run artifacts.