Give the box a second reach (V-649)

Telegram was the only way off this box, and it is not a direct path: it
needs api.telegram.org, a socks relay on the host and a matching ufw rule.
Each of those three has failed once, and when they do a sev4 nudge has
nowhere to go. ntfy shares none of them.

The spare is the smaller half of it. The routing table already sends
sev3-away nudges and away reminders to ntfy and to nothing else, so with no
block configured those two routes hit a nil sink in DispatchNudge and
DispatchReminder and are skipped — no log line, no delivery_attempts row.
An away reminder is worse than dropped: out stays empty, so MarkReminder
never runs and it re-fires every tick without ever being delivered.

Owner's call, 07-08-2026: ntfy.kvmx.ru, topic maven.

The sink now takes a bearer token, which is what that server wants and what
it could not do before. ntfy scopes a token to one topic and to write-only,
so a popped sink can push to the maven topic and cannot read it back. Basic
auth stays for a server with no tokens; configuring both is refused rather
than resolved by guessing.

Config keys got json tags. docs/operations.md has documented this block as
base_url/topic since before it existed, and the untagged struct would only
have answered to BaseURL/Topic — the documented config would have parsed
into an empty one.

The token is a ${NTFY_TOKEN} expansion from the gitignored
deploy/telegram.env, beside the telegram secrets. TestDeployConfigLoads now
fails if the block goes missing, because deleting it is how you turn the
reach off and the two silent routes are what that costs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YMNNEkYx1mZFtHNrFk7uqb

deploy/mavend.json

@@ -25,6 +25,25 @@
     "llm_nudges": false
   },
 
+  "//ntfy": [
+    "The second reach (V-649). Until 07-08-2026 telegram was the only one, and",
+    "telegram needs api.telegram.org, the socks relay below and a matching ufw",
+    "rule — three things in series that have each failed once, and when they do",
+    "a sev4 nudge has nowhere to go. ntfy shares none of them: it is reached",
+    "directly, no relay.",
+    "It is not only a spare. The routing table sends sev3-away and away",
+    "reminders here and NOWHERE else, so with this block absent those two",
+    "routes hit a nil sink and vanish without a log or an outbox row.",
+    "The credential is an ntfy access token, scoped write-only to this one",
+    "topic, so a popped sink can push to it and cannot read it back. Set it in",
+    "deploy/telegram.env beside the telegram secrets; that file is gitignored."
+  ],
+  "ntfy": {
+    "base_url": "https://ntfy.kvmx.ru",
+    "topic": "maven",
+    "token": "${NTFY_TOKEN}"
+  },
+
   "telegram": {
     "bot_token": "${TELEGRAM_BOT_TOKEN}",
     "chat_id": "${TELEGRAM_CHAT_ID}",

deploy/telegram.env.example

@@ -1,5 +1,12 @@
-# Telegram bot token and chat ID for mavend's away-channel reach.
+# Secrets for mavend's away-channel reaches. The file is still called
+# telegram.env because compose names it that; it holds both reaches now.
 # Copy this file to deploy/telegram.env and fill in real values.
 # deploy/telegram.env is gitignored — never commit the real secrets.
 TELEGRAM_BOT_TOKEN=
 TELEGRAM_CHAT_ID=
+
+# ntfy access token for the `maven` topic, the second reach (V-649). Mint it on
+# the ntfy server with write access to that topic and nothing else:
+#   ntfy token add --expires=never maven
+# Read access is not needed — mavend publishes and never subscribes.
+NTFY_TOKEN=