test(ctl): raise commands/notify.rs coverage to 80% (likely 2-3 PRs)

[maiconburn]

crates/ctl/src/commands/notify.rs (~50KB, 8.35% coverage, 54/647 lines; ~464 lines to hit 80%). Setup for Telegram / Slack / webhook / Web Push / dashboard auth, plus digest scheduling.

Scope note

At +464 uncovered lines this is likely 2-3 PRs:

• notify-a: Telegram flow (bot token validation, group id auto-detect, digest hour parse, chat preview)
• notify-b: Slack + webhook (URL validation, signature headers, test-message dispatch)
• notify-c: dashboard + Web Push keys (ed25519/p256 gen, key persist, session timeout logic)

Suggested tests (cross-cutting)

• DigestHourConfig parse (Disabled / Hour(0..=23) / invalid input)
• Env var writes idempotency (write -> re-write same value is a no-op)
• Credential masking in audit entries (admin-actions-*.jsonl)
• Each provider setup happy path with fake HTTP
• Each provider error path surfaces actionable message

Acceptance

cargo test -p innerwarden-ctl notify >= existing + ~20 new; file coverage >= 80%.
Estimated effort: 2-3 PRs, 15-20h total.