fix(observ): Address the observability review follow-ups

[nfebe]

Notification targets no longer expose their credentials. A target's URL carries its secret inline (an SMTP password, a webhook token), and it was returned in full by the settings API and written to a world-readable file. The URL is now masked in API responses and the file is owner-only, and saving a target back with a masked URL keeps the stored secret rather than overwriting it.

The health watcher no longer blocks health reads while it restarts a container: the restart, a blocking operation, now runs without the lock that those reads need.

Turning auto-restart on or off now works from an assistant session that is not scoped to a single deployment. It is a host-wide setting, so it is gated on permission to change settings instead of demanding a deployment it cannot name.

These are the non-blocking follow-ups from the #148 review.

[sourceant]

Code Review Summary

This PR successfully addresses non-blocking follow-up items from the observability review. It introduces critical security improvements for credential handling and enhances the responsiveness of the health monitoring system.

🚀 Key Improvements

• Credential masking for notification targets in API responses.
• Tightened file system permissions for configuration storage.
• Optimized HealthWatcher to prevent blocking health reads during container restarts.
• Support for global host-wide AI tool mutations with appropriate permission gating.

💡 Minor Suggestions

• Improve robustness of notify.Update when handling invalid IDs with masked URLs.

[sourceant]

Review complete. See the overview comment for a summary.

[sourceant]

When restoring a masked URL, if the provided target ID is not found in the existing configuration, the URL will be silently set to an empty string due to how Go map lookups work. Explicitly checking for the ID's existence before restoring would prevent accidentally clearing the URL if an invalid ID is provided with a masked constant.

Suggested change

	for i := range cfg.Targets {
	for i, t := range cfg.Targets {
	if t.URL == MaskedURL {
	if orig, ok := byID[t.ID]; ok {
	cfg.Targets[i].URL = orig
	}
	}
	}