Track migration from Shoutrrr to notify v1.5.0 (phased rollout)

[Wikid82]

Summary

Shoutrrr is unmaintained. Track the phased migration to github.com/nikoksr/notify (v1.5.0) using the approved implementation spec in docs/plans/current_spec.md.

Foundation QoL requirement (PR-1)

Security notification setup must be centralized in standard Notification settings.

• Remove duplicate editable setup surfaces that currently split configuration across Security and Notifications.
• Keep legacy behavior backward compatible for existing settings.
• Security dashboard path should be deprecated/non-editable and direct users to Notifications settings.

Important constraint update

Gotify is not treated as notify-native in this migration.

• Discord remains notify-based (first service rollout).
• Gotify (second rollout) is integrated via the existing Gotify CLI instead of a notify adapter.
• PR-3 includes CLI installation/runtime validation and secure command execution constraints.

Goals

• Replace transport engine without breaking persisted notification providers.
• Deliver in multiple small, reversible PRs.
• Gate each service release behind tests + feature flags.
• Reduce user confusion by having a single canonical notification setup location.

Service rollout order

1. Discord (notify-based)
2. Gotify (CLI-based)
3. Remaining services (no strict order)

PR slicing (high-level)

• PR-1: Foundation migration (dual-engine scaffold, compatibility, feature flags, additive API/model prep, and Security→Notifications setup consolidation; no forced service switch)
• PR-2: Discord implementation (notify) + UI + unit/E2E tests
• PR-3: Gotify implementation (CLI) + template normalization/fixes + unit/E2E tests
• PR-4+: Remaining services in small batches

Release controls

• Feature flags per engine/service.
• Backward compatibility and fallback remain enabled until parity is achieved.
• Rollback is service-level via flag disablement.

Tracking checklist

• PR-1 foundation merged (including setup centralization QoL change)
• Security dashboard no longer presents duplicate editable notification setup
• Discord slice merged and validated (unit + E2E)
• Gotify CLI slice merged and validated (unit + E2E)
• Additional service slices planned and tracked
• Deprecation plan for legacy Shoutrrr path published

Validation gates per slice

• Playwright targeted notification flows
• Local patch report artifacts generated
• Backend/frontend coverage checks
• CodeQL + Trivy + Go vuln check
• GORM security scan when model/database files are touched

All Services

• Amazon SES
• Amazon SNS
• Bark
• DingTalk
• Discord
• Email
• Firebase Cloud Messaging
• Google Chat
• HTTP
• Lark
• Line
• Line Notify
• Mailgun
• Matrix
• Microsoft Teams
• PagerDuty
• Plivo
• Pushover
• Pushbullet
• Reddit
• RocketChat
• SendGrid
• Slack
• Syslog
• Telegram
• TextMagic
• Twilio
• Twitter
• Viber
• WeChat
• Webpush Notification
• WhatsApp

Spec reference

• docs/plans/current_spec.md

Notes

This issue is for migration orchestration and phase tracking. Detailed design, risks, rollback triggers, and acceptance criteria are maintained in the spec.