feat: add operator config options for Apprise notifications (closes #1576)

Adds three new environment variables that give instance operators control
over Apprise notification services, addressing GDPR and compliance concerns
around third-party data transfers.

## New environment variables

- APPRISE_ENABLED (default: true)
  Set to "false" to globally prevent users from creating Apprise notification
  services and to silently skip sending any Apprise notifications. Existing
  services in the database are preserved but not used while disabled.

- APPRISE_ALLOWED_SCHEMAS (default: empty — no restriction)
  Comma-separated allowlist of Apprise URL schemas (e.g. "slack,tgram").
  When set, only services whose URL schema appears in this list can be
  created or will be sent. Takes priority over APPRISE_BLOCKED_SCHEMAS.
  Uses Apprise's internal schema names (e.g. "tgram" for Telegram).

- APPRISE_BLOCKED_SCHEMAS (default: empty — built-in list applies)
  Comma-separated blocklist of Apprise URL schemas (e.g. "discord,slack").
  When set, replaces the built-in blocked list entirely. When empty, the
  built-in list (syslog, dbus, kde, qt, glib, gnome, macosx, windows)
  continues to apply as a fallback.

## Enforcement

Validation happens at two layers:

1. API layer (create endpoints for user and board notification services)
   Returns HTTP 403 when Apprise is disabled, HTTP 422 when the URL schema
   is not permitted. This gives users immediate feedback in the UI.

2. Python send layer (send_notifications.py)
   The schema config is passed as a JSON argument so the same allow/block
   rules apply at send time, guarding against services that were created
   before the config was tightened.

## Files changed

- server/config/custom.js — parse new env vars via existing envToArray helper
- server/utils/send_notifications.py — accept schemaConfig as argv[4]; replace
  hard-coded BLOCKED_SCHEMAS_SET with dynamic allowed/blocked resolution
- server/api/helpers/utils/send-notifications.js — short-circuit when disabled;
  pass schemaConfig JSON to the Python script
- server/api/helpers/notification-services/create-one-in-{user,board}.js — add
  appriseDisabled and schemaNotAllowed exits with schema validation logic
- server/api/controllers/notification-services/create-in-{user,board}.js — wire
  new exits to forbidden (403) and unprocessableEntity (422) responses
- server/.env.sample — document all three new variables with comments

server/api/helpers/notification-services/create-one-in-board.js

@@ -23,11 +23,28 @@ module.exports = {
   },
 
   exits: {
+    appriseDisabled: {},
+    schemaNotAllowed: {},
     limitReached: {},
   },
 
   async fn(inputs) {
     const { values } = inputs;
+    const { appriseEnabled, appriseAllowedSchemas, appriseBlockedSchemas } = sails.config.custom;
+
+    if (!appriseEnabled) {
+      throw 'appriseDisabled';
+    }
+
+    const schema = values.url.split(':')[0];
+
+    if (appriseAllowedSchemas.length > 0 && !appriseAllowedSchemas.includes(schema)) {
+      throw 'schemaNotAllowed';
+    }
+
+    if (appriseAllowedSchemas.length === 0 && appriseBlockedSchemas.includes(schema)) {
+      throw 'schemaNotAllowed';
+    }
 
     const notificationServicesTotal = await sails.helpers.boards.getNotificationServicesTotal(
       values.board.id,

server/api/helpers/notification-services/create-one-in-user.js

@@ -19,11 +19,28 @@ module.exports = {
   },
 
   exits: {
+    appriseDisabled: {},
+    schemaNotAllowed: {},
     limitReached: {},
   },
 
   async fn(inputs) {
     const { values } = inputs;
+    const { appriseEnabled, appriseAllowedSchemas, appriseBlockedSchemas } = sails.config.custom;
+
+    if (!appriseEnabled) {
+      throw 'appriseDisabled';
+    }
+
+    const schema = values.url.split(':')[0];
+
+    if (appriseAllowedSchemas.length > 0 && !appriseAllowedSchemas.includes(schema)) {
+      throw 'schemaNotAllowed';
+    }
+
+    if (appriseAllowedSchemas.length === 0 && appriseBlockedSchemas.includes(schema)) {
+      throw 'schemaNotAllowed';
+    }
 
     const notificationServicesTotal = await sails.helpers.users.getNotificationServicesTotal(
       values.user.id,