Add ntfy push notifications for security-relevant events

Sends alerts on admin login, new registrations, user disable/delete, and
impersonation. NTFY_URL and NTFY_TOKEN are optional — leave blank to disable.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/ntfy.py

@@ -0,0 +1,27 @@
+import logging
+import os
+
+import httpx
+
+logger = logging.getLogger("yolkbook")
+
+
+def notify(title: str, message: str, priority: str = "default", tags: list[str] | None = None) -> None:
+    """Send a fire-and-forget notification to ntfy. Silently logs errors — never raises."""
+    url = os.environ.get("NTFY_URL", "")
+    if not url:
+        return
+
+    headers = {"Title": title, "Priority": priority}
+    if tags:
+        headers["Tags"] = ",".join(tags)
+    token = os.environ.get("NTFY_TOKEN", "")
+    if token:
+        headers["Authorization"] = f"Bearer {token}"
+
+    try:
+        with httpx.Client(timeout=5) as client:
+            resp = client.post(url, content=message, headers=headers)
+            resp.raise_for_status()
+    except Exception as exc:
+        logger.warning("Ntfy notification failed: %s", exc)