Owner notices: the stall, one webhook path from env to Discord (#171)

Rollout note: the owner_notices table starts empty, so the first pass after deploy sends for conditions already true — correct per one-row-per-episode; say so rather than have it reported as a bug. Prod step: create the webhook, set DISCORD_WEBHOOK_URL on the deployment, redeploy — unset is silent by design, and without that step the feature ships dark. Security invariants preserved: the webhook address is a secret in the class of TOKEN_KEY (never logged, never on a config-printing line), and the owner gate is unchanged.

backend/main.go

@@ -14,6 +14,7 @@ import (
 	"bookmarkmanager/backend/internal/api"
 	"bookmarkmanager/backend/internal/httpmw"
 	"bookmarkmanager/backend/internal/latest"
+	"bookmarkmanager/backend/internal/notify"
 	"bookmarkmanager/backend/internal/store"
 	"bookmarkmanager/backend/internal/token"
 	"bookmarkmanager/backend/internal/userscript"
@@ -59,6 +60,12 @@ type Config struct {
 	// the Lanes page reports the fact and derives reachability from the pass
 	// log rather than asking the poller (issue #145).
 	BrowserWSURL string
+	// DiscordWebhookURL is the webhook owner notices post to (issue #171).
+	// Unset means the whole path is off — a local stack needs no webhook,
+	// exactly as the browser URL behaves. The address is a secret in the
+	// class of TOKEN_KEY: never logged, and it must not reach any line that
+	// prints configuration.
+	DiscordWebhookURL string
 	// LatestPoll configures the background latest-chapter fetcher.
 	LatestPoll LatestPoll
 }
@@ -114,6 +121,7 @@ func loadConfig() Config {
 		UserscriptPath:      envOr("USERSCRIPT_PATH", "/userscript/manga-bookmark.user.js"),
 		NovelUserscriptPath: envOr("NOVEL_USERSCRIPT_PATH", "/userscript/novel-bookmark.user.js"),
 		BrowserWSURL:        os.Getenv("BROWSER_WS_URL"),
+		DiscordWebhookURL:   os.Getenv("DISCORD_WEBHOOK_URL"),
 		LatestPoll:          loadLatestPoll(),
 	}
 	c.Discord = web.DiscordConfig{
@@ -288,10 +296,22 @@ func main() {
 		}
 		s.OnSeriesCreated = acq.Acquire
 	}
+	// Owner notices (issue #171): a configured webhook makes the poller tell
+	// the owner about stalled Lanes. Unset means the whole path is off — a
+	// local stack needs no webhook, exactly as the browser URL behaves. Only
+	// the presence is logged; the address itself is a secret in the class of
+	// TOKEN_KEY.
+	var notifier latest.Notifier
+	if u := strings.TrimSpace(cfg.DiscordWebhookURL); u != "" {
+		notifier = notify.New(u, cfg.PublicBaseURL)
+		log.Println("owner notices: enabled")
+	} else {
+		log.Println("owner notices: disabled (DISCORD_WEBHOOK_URL unset)")
+	}
 	// The poller's only connection to the web layer is the database now: it is
 	// started for its own sake, and the Lanes page reads the pass rows it
 	// records (issue #145).
-	startLatestPoller(pollCtx, s, cfg.LatestPoll, browser)
+	startLatestPoller(pollCtx, s, cfg.LatestPoll, browser, notifier)
 
 	srv := &http.Server{
 		Addr:              ":" + cfg.Port,
@@ -324,7 +344,9 @@ func main() {
 
 // newLatestPoller wires the fetcher seams into the poller. Pace is registry
 // property, not config (issue #100), so there are no knobs to pass through.
-func newLatestPoller(s *store.Store, cfg LatestPoll, fetch, browser latest.Fetcher) *latest.Poller {
+// notifier is nil when no webhook is configured: a missing webhook is a
+// silent off switch, not an error (issue #171).
+func newLatestPoller(s *store.Store, cfg LatestPoll, fetch, browser latest.Fetcher, notifier latest.Notifier) *latest.Poller {
 	var covers latest.BrowserCoverFetcher
 	if f, ok := browser.(latest.BrowserCoverFetcher); ok {
 		covers = f
@@ -335,6 +357,7 @@ func newLatestPoller(s *store.Store, cfg LatestPoll, fetch, browser latest.Fetch
 		BrowserFetch:    browser,
 		CoverFetch:      covers,
 		CoverBytesFetch: latest.NewCoverFetcher(),
+		Notify:          notifier,
 		Now:             time.Now,
 	}
 }
@@ -345,7 +368,8 @@ func newLatestPoller(s *store.Store, cfg LatestPoll, fetch, browser latest.Fetch
 // tracking, which is exactly how it behaved before. It returns the running
 // Poller, or nil when there is none; the caller starts it for its own sake —
 // the Lanes page reads the pass log, so no return value is wired anywhere.
-func startLatestPoller(ctx context.Context, s *store.Store, cfg LatestPoll, browser latest.Fetcher) *latest.Poller {
+// notifier is nil when DISCORD_WEBHOOK_URL is unset (issue #171).
+func startLatestPoller(ctx context.Context, s *store.Store, cfg LatestPoll, browser latest.Fetcher, notifier latest.Notifier) *latest.Poller {
 	if !cfg.Enabled {
 		log.Println("latest-chapter poller: disabled by config")
 		return nil
@@ -358,7 +382,7 @@ func startLatestPoller(ctx context.Context, s *store.Store, cfg LatestPoll, brow
 	// Nil browser: sites behind a JavaScript challenge are simply not polled,
 	// and their latest_chapter comes from the userscript alone — which is how
 	// the service behaved before the sidecar existed.
-	p := newLatestPoller(s, cfg, f, browser)
+	p := newLatestPoller(s, cfg, f, browser, notifier)
 
 	go p.Run(ctx)
 	return p