Digest expansion: ten new toggleable email report sections

[Polliog]

Expands the daily/weekly digest email so every LogTide vertical can report into it. Ten new sections, all disabled by default and individually toggleable per organization; the five original sections are now toggleable too (enabled by default), so existing digests are unchanged until someone opts in.

What's included

• Section toggles: digest_configs gains a sections JSONB column (migration 057, NULL = defaults). The shared catalog (DIGEST_SECTION_KEYS, DIGEST_SECTION_DEFAULTS, mergeDigestSections in @logtide/shared) drives the backend Zod schema, the generator gating and the settings UI, so the three cannot drift. Stored values are minimal partials (the UI sends only keys that differ from defaults); the dispatch cron enqueues the merged record in the job payload, so the generator adds no config query and pre-deploy queued jobs fall back to defaults.
• New sections (off by default): log level breakdown with error rate and per-day volumes (weekly), top error messages, traces (span volume, per-service p95/error rate, slowest spans), metrics datapoints, alerts triggered with top rules, security activity (incidents opened/resolved by severity, top MITRE techniques), monitor performance (avg/p95 response time, failed checks), usage (per-project ingestion, month-to-date quota warnings), webhook deliveries (delivered/failed/dead), team activity (member changes, config changes, failed logins).
• Settings UI: new Sections card in Settings > Email Digests with one switch per section; the form now saves schedule and sections together ("Save Settings").
• Email template: all sections render in HTML and plaintext, every user-controlled string escaped (injection payloads tested per section), disabled or empty sections skipped entirely, quiet-period and preheader logic section-aware.
• Multi-engine fix: MongoDB span queries now accept the same sort fields as TimescaleDB and ClickHouse (duration_ms, end_time, service_name, operation_name); previously any sort other than start_time was silently ignored, which would have made "slowest spans" render most-recent spans on Mongo.

Tenancy and safety

• Every new query is org-scoped; alert_history through the alert_rules join (it has no org column), monitor_results on both sides of the monitors join (no FK exists on the hypertable). check:tenant-scoping passes (324 sites).
• Detection MITRE aggregation unnests a single array (avoids the [BUG] Cannot read properties of null (reading 'toLowerCase') #200 lockstep NULL-padding bug).
• Disabled sections cost zero queries; the heavyweight capability-usage module is lazily imported only when the usage section is enabled.

Verification

• Backend full suite green (exit 0; digests dir 87, email templates 91, tsc clean)
• Reservoir: 483 passed / 7 skipped (Redis transport only), ClickHouse and MongoDB integration suites running against real containers including the new sort-parity tests
• Frontend: 159 tests passing; svelte-check at the pre-existing 9 errors / 23 warnings baseline
• Shared: 199 tests passing

[codecov]

Codecov Report

❌ Patch coverage is 99.37695% with 6 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
packages/backend/src/modules/digests/generator.ts	99.17%	4 Missing ⚠️
packages/backend/src/lib/email-templates.ts	99.55%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!