Merge pull request 'fix(notification): enable web smtp test with saved password' (#25) from fix/notification-web-smtp-test into main

Allow Web SMTP egress on TCP 587 and reuse the saved channel password only when connection settings match.

Ref: IT-1601

HrynCo.NotificationService.Web.IntegrationTests/AdminSmtpEditorViewTests.cs

@@ -0,0 +1,34 @@
+using HrynCo.NotificationService.DAL.Abstract.Providers;
+using HrynCo.NotificationService.DAL.Abstract.Repositories;
+using HrynCo.NotificationService.DAL.EF;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace HrynCo.NotificationService.Web.IntegrationTests;
+
+public sealed class AdminSmtpEditorViewTests(TemplateDatabaseFixture fixture) : IClassFixture<TemplateDatabaseFixture>
+{
+    [Fact]
+    public async Task ExistingChannelTestIncludesIdWithoutRenderingSavedPassword()
+    {
+        await using var context = await DefinitionApiTestContext.CreateAsync(fixture);
+        using var scope = context.App.Services.CreateScope();
+        var channel = new EmailChannel
+        {
+            ServiceName = "TestService",
+            EmailChannelType = EmailChannelType.Smtp,
+            Settings = new SmtpChannelSettings
+            {
+                Host = "smtp.example.invalid", Username = "test-user",
+                Password = "saved-secret-must-not-render", FromEmail = "sender@example.invalid"
+            }
+        };
+        await scope.ServiceProvider.GetRequiredService<IEmailChannelRepository>().AddAsync(channel);
+        await scope.ServiceProvider.GetRequiredService<NotificationDbContext>().SaveChangesAsync();
+
+        var html = await context.Client.GetStringAsync($"/admin/channels/{channel.Id}");
+
+        Assert.Contains($"value=\"{channel.Id}\"", html);
+        Assert.Contains("const channelId = form.querySelector('[name=\"Id\"]').value", html);
+        Assert.DoesNotContain("saved-secret-must-not-render", html);
+    }
+}

HrynCo.NotificationService.Web.IntegrationTests/AdminSmtpTestControllerTests.cs

@@ -0,0 +1,112 @@
+using System.Reflection;
+using System.Text.Json;
+using HrynCo.NotificationService.DAL.Abstract.Providers;
+using HrynCo.NotificationService.Web.Controllers.Admin;
+using MediatR;
+using Microsoft.AspNetCore.Mvc;
+
+namespace HrynCo.NotificationService.Web.IntegrationTests;
+
+public sealed class AdminSmtpTestControllerTests
+{
+    private static readonly Guid ChannelId = Guid.NewGuid();
+
+    [Fact]
+    public async Task BlankPasswordUsesSavedSecretAndCurrentUnsavedSender()
+    {
+        var (controller, recorder) = CreateController();
+        var response = await controller.TestSmtp(Request(), CancellationToken.None);
+
+        Assert.True(Succeeded(response));
+        Assert.Equal("saved-test-secret", recorder.SentCommand?.Password);
+        Assert.Equal("changed@example.invalid", recorder.SentCommand?.FromEmail);
+        Assert.Equal("Changed sender", recorder.SentCommand?.FromName);
+        Assert.Equal(1, recorder.LookupCount);
+        Assert.DoesNotContain("saved-test-secret", JsonSerializer.Serialize(((OkObjectResult)response).Value));
+    }
+
+    [Fact]
+    public async Task ExplicitPasswordOverridesSavedWithoutLookup()
+    {
+        var (controller, recorder) = CreateController();
+        var response = await controller.TestSmtp(Request() with { Password = "typed-test-secret" }, CancellationToken.None);
+
+        Assert.True(Succeeded(response));
+        Assert.Equal("typed-test-secret", recorder.SentCommand?.Password);
+        Assert.Equal(0, recorder.LookupCount);
+    }
+
+    [Theory]
+    [InlineData("host")]
+    [InlineData("port")]
+    [InlineData("username")]
+    [InlineData("ssl")]
+    public async Task ChangedConnectionRequiresExplicitPassword(string field)
+    {
+        var (controller, recorder) = CreateController();
+        var request = field switch
+        {
+            "host" => Request() with { Host = "other.example.invalid" },
+            "port" => Request() with { Port = 2525 },
+            "username" => Request() with { Username = "other-user" },
+            _ => Request() with { UseSsl = false }
+        };
+
+        var response = await controller.TestSmtp(request, CancellationToken.None);
+
+        Assert.False(Succeeded(response));
+        Assert.Null(recorder.SentCommand);
+    }
+
+    [Fact]
+    public async Task UnknownChannelDoesNotSend()
+    {
+        var (controller, recorder) = CreateController();
+        recorder.Channel = null;
+
+        var response = await controller.TestSmtp(Request(), CancellationToken.None);
+
+        Assert.False(Succeeded(response));
+        Assert.Null(recorder.SentCommand);
+    }
+
+    [Fact]
+    public async Task NewChannelKeepsAdHocTestBehavior()
+    {
+        var (controller, recorder) = CreateController();
+
+        var response = await controller.TestSmtp(Request() with { ChannelId = null }, CancellationToken.None);
+
+        Assert.True(Succeeded(response));
+        Assert.Equal(string.Empty, recorder.SentCommand?.Password);
+        Assert.Equal(0, recorder.LookupCount);
+    }
+
+    private static (AdminChannelsController Controller, RecordingAdminSmtpMediator Recorder) CreateController()
+    {
+        var mediator = DispatchProxy.Create<IMediator, RecordingAdminSmtpMediator>();
+        var recorder = (RecordingAdminSmtpMediator)mediator;
+        recorder.Channel = new EmailChannel
+        {
+            Id = ChannelId,
+            ServiceName = "TestService",
+            EmailChannelType = EmailChannelType.Smtp,
+            Settings = new SmtpChannelSettings
+            {
+                Host = "smtp.example.invalid", Port = 587,
+                Username = "test-user", Password = "saved-test-secret", UseSsl = true
+            }
+        };
+        return (new AdminChannelsController(mediator), recorder);
+    }
+
+    private static TestSmtpRequest Request() => new(
+        "smtp.example.invalid", 587, "test-user", "", true,
+        "changed@example.invalid", "Changed sender", "recipient@example.invalid", ChannelId);
+
+    private static bool Succeeded(IActionResult response)
+    {
+        var body = JsonSerializer.Serialize(((OkObjectResult)response).Value);
+        return JsonDocument.Parse(body).RootElement.GetProperty("success").GetBoolean();
+    }
+}

HrynCo.NotificationService.Web.IntegrationTests/RecordingAdminSmtpMediator.cs

@@ -0,0 +1,43 @@
+using System.Reflection;
+using HrynCo.NotificationService.DAL.Abstract.Providers;
+using HrynCo.NotificationService.Services.Core;
+using HrynCo.NotificationService.Services.EmailChannels.Get;
+using HrynCo.NotificationService.Services.EmailChannels.TestSmtp;
+using MediatR;
+using ServiceUnit = HrynCo.NotificationService.Services.Core.Unit;
+
+namespace HrynCo.NotificationService.Web.IntegrationTests;
+
+public class RecordingAdminSmtpMediator : DispatchProxy
+{
+    public EmailChannel? Channel { get; set; }
+    public TestSmtpCommand? SentCommand { get; private set; }
+    public int LookupCount { get; private set; }
+
+    protected override object Invoke(MethodInfo? targetMethod, object?[]? args)
+    {
+        if (targetMethod?.Name != nameof(IMediator.Send) || args?.Length is null or 0)
+            throw new NotSupportedException();
+
+        return args[0] switch
+        {
+            GetEmailChannelQuery => RecordLookup(),
+            TestSmtpCommand command => RecordSend(command),
+            _ => throw new NotSupportedException()
+        };
+    }
+
+    private Task<ServiceResult<EmailChannel>> RecordLookup()
+    {
+        LookupCount++;
+        return Task.FromResult(Channel is null
+            ? ServiceResult<EmailChannel>.Failure("Channel not found.")
+            : ServiceResult<EmailChannel>.Success(Channel));
+    }
+
+    private Task<ServiceResult<ServiceUnit>> RecordSend(TestSmtpCommand command)
+    {
+        SentCommand = command;
+        return Task.FromResult(ServiceResult<ServiceUnit>.Success(ServiceUnit.Value));
+    }
+}

HrynCo.NotificationService.Web/Controllers/Admin/AdminChannelsController.cs

@@ -138,8 +138,21 @@ public class AdminChannelsController(IMediator mediator) : Controller
     [HttpPost("test-smtp")]
     public async Task<IActionResult> TestSmtp([FromBody] TestSmtpRequest request, CancellationToken ct)
     {
+        var password = request.Password;
+        if (string.IsNullOrEmpty(password) && request.ChannelId is Guid channelId)
+        {
+            var channelResult = await mediator.Send(new GetEmailChannelQuery(channelId), ct);
+            if (!channelResult.IsSuccess || channelResult.Result?.Settings is not SmtpChannelSettings saved)
+                return Ok(new { success = false, message = "SMTP channel not found." });
+
+            if (!MatchesSavedSmtpConnection(request, saved))
+                return Ok(new { success = false, message = "Enter the password to test changed SMTP connection settings." });
+
+            password = saved.Password;
+        }
+
         var result = await mediator.Send(new TestSmtpCommand(
-            request.Host, request.Port, request.Username, request.Password,
+            request.Host, request.Port, request.Username, password ?? string.Empty,
             request.UseSsl, request.FromEmail, request.FromName, request.ToEmail), ct);
 
         if (!result.IsSuccess)
@@ -148,6 +161,12 @@ public class AdminChannelsController(IMediator mediator) : Controller
         return Ok(new { success = true, message = $"Test email sent to {request.ToEmail}." });
     }
 
+    private static bool MatchesSavedSmtpConnection(TestSmtpRequest request, SmtpChannelSettings saved) =>
+        string.Equals(request.Host, saved.Host, StringComparison.OrdinalIgnoreCase)
+        && request.Port == saved.Port
+        && string.Equals(request.Username, saved.Username, StringComparison.Ordinal)
+        && request.UseSsl == saved.UseSsl;
+
     // POST /admin/channels/{id}/test
     [HttpPost("{id:guid}/test")]
     public async Task<IActionResult> Test(Guid id, [FromBody] TestChannelRequest request, CancellationToken ct)
@@ -180,6 +199,3 @@ public class AdminChannelsController(IMediator mediator) : Controller
 }
 
 public record TestChannelRequest(string ToEmail);
-public record TestSmtpRequest(
-    string Host, int Port, string Username, string Password,
-    bool UseSsl, string FromEmail, string FromName, string ToEmail);

HrynCo.NotificationService.Web/Controllers/Admin/TestSmtpRequest.cs

@@ -0,0 +1,6 @@
+namespace HrynCo.NotificationService.Web.Controllers.Admin;
+
+public record TestSmtpRequest(
+    string Host, int Port, string Username, string Password,
+    bool UseSsl, string FromEmail, string FromName, string ToEmail,
+    Guid? ChannelId = null);

HrynCo.NotificationService.Web/Views/AdminChannels/Edit.cshtml

@@ -138,7 +138,7 @@
                 <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
             </div>
             <div class="modal-body">
-                <p class="text-muted small">Tests the current form settings — no need to save first.</p>
+                <p class="text-muted small">Tests the current form settings — no need to save first. For an existing channel, a blank password uses the saved password only when the SMTP connection settings are unchanged.</p>
                 <label for="testToEmail" class="form-label fw-semibold">Recipient Email</label>
                 <input type="email" id="testToEmail" class="form-control" placeholder="you@example.com" />
                 <div id="testResult" class="mt-3" style="display:none"></div>
@@ -173,7 +173,9 @@
         }
 
         const form = document.getElementById('channelForm');
+        const channelId = form.querySelector('[name="Id"]').value;
         const payload = {
+            channelId: channelId === '00000000-0000-0000-0000-000000000000' ? null : channelId,
             host: form.querySelector('[name="Host"]').value,
             port: parseInt(form.querySelector('[name="Port"]').value, 10),
             username: form.querySelector('[name="Username"]').value,

docker/kubernetes/shared-notification/README.md

@@ -80,6 +80,17 @@ published, accepted by the Gmail SMTP channel, acknowledged as delivery successe
 Invemory Outbox, and confirmed in the recipient's Gmail conversation. Today's channel
 usage increased by two. Both queues ended with zero ready and unacknowledged messages.
 
+### Administrative SMTP test from Web — 2026-10-18
+
+The channel editor's **Send Test Email** action sends directly from Web through SMTP;
+it does not use the Worker or RabbitMQ. Its TCP 587 connection timed out while the
+production network policy allowed external SMTP only from Worker. The additive
+`web-to-external-smtp` policy in `production-network.yaml` grants Web the same public
+IPv4 TCP 587 egress as Worker, with the same private and cluster address exclusions.
+Apply this production overlay separately from the sandbox-only `notification.py`
+render. No SMTP credentials, channel settings, templates, or workload restart are
+required for this network change.
+
 The activation helper also persists the production user, queue and expanded Worker ACL
 in the `rabbit-definitions` Secret. The private password and matching RabbitMQ hash
 are saved with mode `0600`; updated `notification.py` reproduces that Secret during
@@ -167,7 +178,8 @@ existing Dockerfile. Record the checked commit and archive SHA256, including any
 explicitly recorded uncommitted delta. Mirror PostgreSQL, RabbitMQ, Mailpit and a
 Python 3 Linux image to `registry.hrynco.com`. Copy `artifacts.example.json` to
 `artifacts.local.json` and record all seven immutable image digests, source hashes
-and the two reviewed migration IDs. The script rejects placeholder/tag references,
+and the three reviewed migration IDs, ending with `20261017072410_EmailTemplateLocalizations`.
+The script rejects placeholder/tag references,
 other registries, mismatched application/migrator archives and unsupported DB/broker
 major versions. The archive hash fields are an operator provenance record; independently
 verify the build inputs and registry digests before live application.
@@ -255,13 +267,15 @@ python3 notification.py render --config config.local.json --artifacts artifacts.
 python3 notification.py check --config config.local.json --artifacts artifacts.local.json
 ```
 
-5. First install applies storage/isolated foundation and runs migrations with Web and
-   Worker stopped. The migration target is exactly `InitialCreate` + `PendingChanges`.
+5. First install or a schema upgrade applies storage/isolated foundation and runs
+   migrations with Web and Worker stopped. The migration target is exactly
+   `InitialCreate` + `PendingChanges` + `EmailTemplateLocalizations`.
    After migration success, the script verifies history, grants a separate
-   `notification_runtime` role only DML on the three application tables, and idempotently
-   seeds the Mailpit channel and neutral English `TestEmail`. Existing matching-service
-   channels/templates are left unchanged. It resumes Web after these gates; Worker
-   remains stopped for inspection:
+   `notification_runtime` role only DML on the application tables, including the
+   service/language/definition catalog, and idempotently seeds the Mailpit channel,
+   sandbox service/catalog and neutral English `TestEmail`. Existing matching-service
+   channels/templates and shared variable contracts are left unchanged. It resumes
+   Web after these gates; Worker remains stopped for inspection:
 
 ```sh
 python3 notification.py deploy --config config.local.json --artifacts artifacts.local.json --migrate
@@ -320,6 +334,18 @@ a snapshot of RabbitMQ's queue files. Migration does not upgrade/recreate the br
 volume; durable queues remain on that retained volume. Broker disk backup/recovery
 must be verified before a broker upgrade or storage migration.
 
+Before upgrading a live flat database to `EmailTemplateLocalizations`, inspect the
+exact source columns/indexes/history and audit every template's identities and JSON
+variable shape. Versions of one service/key must have the same variable contract
+after sorting by variable name. Rehearse the current Migrator and sandbox/grants SQL
+on a disposable restored PostgreSQL 17 copy, then verify preserved content and a
+repeat no-op migration. The live `deploy --migrate` creates its own final backup after
+stopping Web and Worker. Do not use the old Web/Worker images with the new schema.
+Rollback requires restoring a verified pre-upgrade database backup with the matching
+old application images; migration `Down` is not a general rollback path. The
+production network add-on and production broker access remain separate, preserved
+resources; verify them and the existing production queues before re-enabling Worker.
+
 ## Access and networking
 
 Use SSH to the deployment host, then forward one local port when needed:

docker/kubernetes/shared-notification/artifacts.example.json

@@ -1,7 +1,7 @@
 {
   "sourceCommit": "REPLACE_WITH_CHECKED_SOURCE_COMMIT",
   "sourceArchiveSha256": "REPLACE_WITH_VERIFIED_SOURCE_ARCHIVE_SHA256",
-  "migrations": ["20260501214629_InitialCreate", "20260502154249_PendingChanges"],
+  "migrations": ["20260501214629_InitialCreate", "20260502154249_PendingChanges", "20261017072410_EmailTemplateLocalizations"],
   "images": {
     "web": {"image": "registry.hrynco.com/hrynco.notificationservice.web@sha256:REPLACE", "sourceArchiveSha256": "REPLACE_WITH_VERIFIED_SOURCE_ARCHIVE_SHA256"},
     "worker": {"image": "registry.hrynco.com/hrynco.notificationservice.worker@sha256:REPLACE", "sourceArchiveSha256": "REPLACE_WITH_VERIFIED_SOURCE_ARCHIVE_SHA256"},

docker/kubernetes/shared-notification/notification.py

@@ -18,7 +18,8 @@ import time
 
 NAMESPACE = "shared-notification"
 MANAGED = "hrynco-shared-notification"
-MIGRATIONS = ["20260501214629_InitialCreate", "20260502154249_PendingChanges"]
+MIGRATIONS = ["20260501214629_InitialCreate", "20260502154249_PendingChanges",
+              "20261017072410_EmailTemplateLocalizations"]
 IMAGE = re.compile(r"registry\.hrynco\.com/[a-z0-9._/-]+@sha256:[a-f0-9]{64}$")
 SHA = re.compile(r"[a-f0-9]{64}$")
 PRODUCTION_RESULT_QUEUE = "invemory.production.notification-results"
@@ -53,7 +54,8 @@ REVOKE ALL ON DATABASE notification_service FROM PUBLIC;
 GRANT CONNECT ON DATABASE notification_service TO notification_runtime;
 REVOKE CREATE ON SCHEMA public FROM PUBLIC;
 GRANT USAGE ON SCHEMA public TO notification_runtime;
-GRANT SELECT, INSERT, UPDATE, DELETE ON email_channels, email_templates, email_channel_usage TO notification_runtime;
+GRANT SELECT, INSERT, UPDATE, DELETE ON email_channels, email_templates, email_channel_usage,
+    services, service_languages, email_template_definitions TO notification_runtime;
 '''
 
 SANDBOX = r'''
@@ -62,11 +64,24 @@ INSERT INTO email_channels (id, service_name, priority, provider_type, settings,
 SELECT gen_random_uuid(), 'Invemory.Staging.Sandbox', 1, 1,
  '{"EmailChannelType":1,"Host":"mailpit","Port":1025,"Username":"","Password":"","UseSsl":false,"FromEmail":"no-reply@local.hrynco.test","FromName":"Invemory Sandbox"}'::jsonb, 90, true, now()
 WHERE NOT EXISTS (SELECT 1 FROM email_channels WHERE service_name = 'Invemory.Staging.Sandbox');
-INSERT INTO email_templates (id, service_name, key, language_code, subject, html_body, text_body, variables, created)
-VALUES (gen_random_uuid(), 'Invemory.Staging.Sandbox', 'TestEmail', 'en', 'Test notification',
- '<p>Hello {{RecipientName}},</p><p>{{Message}}</p>', 'Hello {{RecipientName}}, {{Message}}',
- '[{"name":"RecipientName","required":true},{"name":"Message","required":true}]'::jsonb, now())
-ON CONFLICT (service_name, key, language_code) DO NOTHING;
+INSERT INTO services (id, name, revision, created)
+VALUES (gen_random_uuid(), 'Invemory.Staging.Sandbox', gen_random_uuid(), now())
+ON CONFLICT (name) DO NOTHING;
+INSERT INTO service_languages (id, service_id, code, created)
+SELECT gen_random_uuid(), s.id, 'en', now() FROM services s WHERE s.name = 'Invemory.Staging.Sandbox'
+ON CONFLICT (service_id, code) DO NOTHING;
+INSERT INTO email_template_definitions (id, service_id, key, revision, variables, created)
+SELECT gen_random_uuid(), s.id, 'TestEmail', gen_random_uuid(),
+ '[{"name":"RecipientName","required":true},{"name":"Message","required":true}]'::jsonb, now()
+FROM services s WHERE s.name = 'Invemory.Staging.Sandbox'
+ON CONFLICT (service_id, key) DO NOTHING;
+INSERT INTO email_templates (id, definition_id, service_id, service_language_id, subject, html_body, text_body, created)
+SELECT gen_random_uuid(), d.id, s.id, l.id, 'Test notification',
+ '<p>Hello {{RecipientName}},</p><p>{{Message}}</p>', 'Hello {{RecipientName}}, {{Message}}', now()
+FROM services s JOIN service_languages l ON l.service_id = s.id AND l.code = 'en'
+    JOIN email_template_definitions d ON d.service_id = s.id AND d.key = 'TestEmail'
+WHERE s.name = 'Invemory.Staging.Sandbox'
+ON CONFLICT (definition_id, service_language_id) DO NOTHING;
 COMMIT;
 '''
 
@@ -75,9 +90,12 @@ SANDBOX_CHECK = """SELECT
  settings->>'Host' = 'mailpit' AND settings->>'Port' = '1025' AND
  settings->>'UseSsl' = 'false' AND settings->>'Username' = '' AND settings->>'Password' = '')
  FROM email_channels WHERE service_name = 'Invemory.Staging.Sandbox') AND
- EXISTS (SELECT 1 FROM email_templates WHERE service_name = 'Invemory.Staging.Sandbox'
- AND key = 'TestEmail' AND language_code = 'en'
- AND variables @> '[{"name":"RecipientName","required":true},{"name":"Message","required":true}]'::jsonb)"""
+ EXISTS (SELECT 1 FROM email_templates t
+ JOIN email_template_definitions d ON d.id = t.definition_id AND d.service_id = t.service_id
+ JOIN service_languages l ON l.id = t.service_language_id AND l.service_id = t.service_id
+ JOIN services s ON s.id = t.service_id
+ WHERE s.name = 'Invemory.Staging.Sandbox' AND d.key = 'TestEmail' AND l.code = 'en'
+ AND d.variables @> '[{"name":"RecipientName","required":true},{"name":"Message","required":true}]'::jsonb)"""
 
 
 def read_json(path):
@@ -640,7 +658,7 @@ def deploy(cluster, config, artifacts, args):
             except Exception:
                 cluster.scale("worker", 0)
                 raise
-        print("deployment complete; SMTP is sandbox-only, Invemory publisher cutover is separate")
+        print("deployment complete; verify configured SMTP channels and publisher routes separately")
 
 
 def main(argv=None):

docker/kubernetes/shared-notification/production-network.yaml

@@ -83,3 +83,32 @@ spec:
       ports:
         - protocol: TCP
           port: 587
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: web-to-external-smtp
+  namespace: shared-notification
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/component: web
+      app.kubernetes.io/name: hrynco-shared-notification
+      app.kubernetes.io/managed-by: hrynco-shared-notification
+  policyTypes: [Egress]
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 100.64.0.0/10
+              - 127.0.0.0/8
+              - 169.254.0.0/16
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+              - 224.0.0.0/4
+              - 240.0.0.0/4
+      ports:
+        - protocol: TCP
+          port: 587

docs/email-template-definition-api.md

@@ -73,6 +73,8 @@ The service/catalog lookup, validation, revision check, explicit removals, trans
 
 ## Email channels
 
+In the admin channel editor, **Send Test Email** tests the form's current values without saving them. An explicitly entered password takes precedence. When the password field is blank for an existing channel, the Web server reads its saved password only if host, port, username, and SSL/TLS mode still match the saved SMTP connection. Changed connection settings require an explicit password. The saved password is not placed in the page or test response. A new channel keeps the ad-hoc test behavior, including unauthenticated SMTP when username and password are empty.
+
 - `GET /api/v1/email-channels/all` enumerates **all** channels, including channels whose exact `serviceName` has no service row.
 - Existing `GET /api/v1/email-channels?serviceName={exactName}`, GET by ID, POST, PUT by ID and DELETE by ID remain available. Create returns 201/Location and its existing GUID response; update/delete return 200/Unit.
 - Create supports SMTP (`channelType: 1`). Request/response `settings` explicitly maps `host`, `port`, `username`, `password`, `useSsl`, `fromEmail`, and `fromName`; reads no longer lose derived SMTP fields through an abstract JSON type. Host/fromEmail and a valid port are required. The optional empty username/password support unauthenticated development SMTP.