Add Slack org lifecycle notifications

[fuziontech]

Summary

Adds optional Slack operational notifications for org and managed-warehouse lifecycle events.

• Adds an async notification subsystem with a bounded queue, delivery timeout, Slack incoming-webhook sink, and Prometheus counters for queue drops/delivery failures.
• Emits org_created only when an org row is newly inserted, org_deleted on successful admin deletion, plus warehouse provision/deprovision lifecycle notifications.
• Keeps Slack payloads conservative for a public repo: raw org IDs, database names, endpoints, secrets, buckets, SQL, and customer names are omitted; messages use only an allowlist of low-risk fields by default. Operators can set env-only DUCKGRES_NOTIFICATION_HASH_KEY to include a stable HMAC org reference for Slack-side correlation.
• Documents env-only Slack configuration, defaults, optional HMAC correlation, failure recovery, notification health metrics, and the intentional no-drain shutdown behavior.

Claude review follow-up

Ran Claude Code review with Sonnet. It found no blocking correctness or data-leak bugs. I addressed the non-blocking gaps it raised:

• Added terminal provisioner notification assertions alongside analytics tests.
• Added org_deleted notifications for successful admin deletes.
• Added duckgres_notifications_dropped_total and duckgres_notification_delivery_failures_total.
• Documented that shutdown does not drain the notification queue because delivery is best-effort.

Final self-review follow-up

• Replaced the unsalted SHA-256 org reference with an optional HMAC org reference gated by DUCKGRES_NOTIFICATION_HASH_KEY.
• Default Slack payloads no longer include any org correlation token unless the secret hash key is configured.

Validation

• go test ./internal/notifications ./controlplane/provisioning
• go test ./internal/notifications ./internal/cliboot ./controlplane/provisioning
• go test -tags kubernetes ./controlplane/provisioner
• go test -tags kubernetes ./controlplane/admin -run 'TestCreateOrg|TestRegisterAPI|TestCreateUser|TestListOrgs'
• go test -tags kubernetes ./controlplane/admin -run 'TestDeleteOrgRejectsWhenWarehouseStillExists|TestDeleteOrgSucceedsAfterWarehouseRemoved|TestDeleteOrgCascadesDeletedWarehouse$'
• just test-unit
• just lint

Note: go test -tags kubernetes ./controlplane/admin still reaches existing Postgres-container tests and fails locally because the container cannot start in this environment; narrowed admin handler tests pass. just lint initially exposed a local tooling issue because the installed golangci-lint binary was built with Go 1.25 and panicked on Go 1.26 files. I rebuilt the same golangci-lint v2.8.0 with local Go 1.26.4, then lint passed.

[github-actions]

Test Impact Plan

Deterministic summary of how this PR changes tests, CI runners, and coverage-risk signals.

Summary

Area	Added	Changed	Deleted
Test files	2	3	0
E2E/journey files	0	0	0
Workflow files	0	0	0

Signals

• Test cases: +6 / -0
• Assertions: +33 / -0
• Skips or known failures added: 0
• Workflow continue-on-error added: 0
• Workflow path filters added: 0
• Test commands removed from justfile: 0
• E2E/journey retry lines added: 0

Coverage risk: neutral or increased

No coverage-reduction warnings detected.