Alert channels

Slack, email, generic webhook, or PagerDuty endpoints for incident notifications. Secrets are AES-256-GCM encrypted at rest with HKDF-per-row keys.