Add notification admin queries and safe retry operations

[yacosta738]

Context

Back Office should provide operational visibility into notification delivery without becoming a second notification system. Administrators need to inspect failures, understand whether a retry is safe, and trigger only eligible retries.

Goal

Implement notification administration queries and safe retry operations for operational use.

Scope

• List notifications for operational review.
• Filter by channel, template, and status.
• Inspect failure reason and timestamps.
• Retry eligible failed notifications.
• Reject unsafe retries for token-bound or no-longer-valid messages.

Out of Scope

• Building a separate notification delivery engine.
• Exposing sensitive payloads.
• Blind resend of expired or consumed security-token notifications.

Domain Rules

• Delivery state belongs to Notifications, not to invitation semantics.
• A retry is allowed only when it is safe for the underlying domain action.
• Expired or consumed security-token messages must not be blindly retried.

API Contract

• Prefer explicit admin query endpoints for notification review.
• Prefer explicit retry command for eligible notifications.

Security

• Sensitive payload values must be redacted.
• Notification inspection and retry require explicit administrative authorization.

Audit

• Emit NOTIFICATION_RETRIED audit events for successful retries.

Observability

• Failed notifications, retry attempts, and retry outcomes should be measurable.

Acceptance Criteria

1. Administrators can list and filter notifications by operationally relevant fields.
2. Sensitive payload values are redacted.
3. Eligible failed notifications can be retried safely.
4. Unsafe retries are rejected.
5. Retry operations are audited.

Gherkin

Feature: Notification operations

  Scenario: Inspect failed notifications
    Given failed notifications exist
    When an administrator filters notifications by "FAILED"
    Then failed notifications should be returned
    And sensitive payload values should not be exposed

  Scenario: Retry eligible failed notification
    Given a notification failed because of a temporary provider error
    When an authorized administrator retries the notification
    Then a new delivery attempt should be scheduled

Testing

• Application
• API
• Integration
• Security

Dependencies

• Implement administrative audit event infrastructure #657
• Expose invitation notification delivery for admin operations #661

References

• RFC sections 25, 26, 37, 41, 42, 45

[linear-code]

DALLAY-574