[glm-grade=A] fix(notifications): un-gate 7 dead emitters + repair legacy 4-arg send shape (DC-094)

Two silent-death defects in one class:

1. Seven emitters absent from DEFAULT events, so the send() gate
   (config.events[canonical] !== true) dropped them on every install:
   ssl-cert-expiry, dns-propagation, drift-detected,
   dependency-restart-complete/-failed, recipeRemoved, workflow.
   All now default ON; dependency-restart spellings fold onto one
   canonical toggle; recipeRemoved aliases to recipe-removed in both
   the manager and route alias maps.

2. Nine call sites used a legacy 4-arg send(event, title, message, type)
   against the 3-arg signature: the message string landed in the type
   slot (Discord embed color fell back to info-blue, history.type wrong)
   and providers received the TITLE as the body - deploy-failure
   notifications carried no error text at all. Fixed at source (9 sites)
   plus a type-guarded shim in send() for external legacy callers.

Also: explicit data.title now flows to ntfy Title header, email subject,
Discord embed title, and history; settings UI gains 9 event toggles
(separate Backup Complete/Failed) with defaults-on semantics.

Tests: +24 (new DC-094 suite: defaults, gate pass-through, alias folding
send-time and load-time, stored-config inheritance, shim body/title/
color/subject/history, type-guard, 3-arg no-regression); 4 assertions in
bundled-workflows-health-check updated from the old 4-arg mock contract
to the canonical shape (same behavior asserted). Full suite 116 suites /
2706 tests green.

Judge: GLM-5.3 cold read via delegate_task (deleg_8a7cedd0), grade A,
zero blockers; 2 polish items (Backups toggle conflation, shim
type-guard) folded into this commit. Verdict URN:
urn:ump:uyipjjwdjqjy3alvceqxvlucrymd7hnsben5udpp2bqycoh3l2la

dashcaddy-api/routes/notifications.js

@@ -203,6 +203,11 @@ module.exports = function({ notification, asyncHandler, ok }) {
           backupComplete: 'backup-complete',
           backupFailed: 'backup-failed',
           autoRestart: 'auto-restart',
+          // DC-094: same additions as the manager's EVENT_ALIASES — keep the
+          // two maps in sync so a key saved here is the key send() gates on.
+          recipeRemoved: 'recipe-removed',
+          'dependency-restart-complete': 'dependency-restart',
+          'dependency-restart-failed': 'dependency-restart',
         };
         const folded = {};
         for (const [k, v] of Object.entries(events)) {
@@ -264,7 +269,7 @@ module.exports = function({ notification, asyncHandler, ok }) {
       res.json({ success: result.success, provider, error: result.error });
     } else {
       // Test all enabled providers
-      const result = await notification.send('test', 'Test Notification', 'This is a test notification from DashCaddy.', 'info');
+      const result = await notification.send('test', { title: 'Test Notification', text: 'This is a test notification from DashCaddy.' }, 'info');
       ok(res, { ...result });
     }
   }, 'notifications-test'));