[PBI] Notification actions — navigate and api_call types

[cjlapao]

Description

Implement and validate the actions array on the notification model, ensuring that both navigate and api_call action types are correctly stored, serialised, and returned via the API so the UI has everything it needs to render actionable buttons on a notification.

User Story

As a user viewing an alert notification, I want to see one or more action buttons (e.g. "Go to host", "Acknowledge") so that I can act on the notification directly without having to navigate manually.

Acceptance Criteria

• Action struct validated on creation: Invalid type values (anything other than navigate or api_call) are rejected with a descriptive error at dispatch time.
• navigate action validated: Must have a non-empty target (a UI route string). method and payload must be absent or null.
• api_call action validated: Must have a non-empty target (relative API path) and a valid method (GET, POST, PUT, PATCH, DELETE). payload is optional.
• Serialisation round-trip: Actions are stored as JSON and deserialised correctly on every read. An empty actions array is stored and returned as [] not null.
• Multiple actions supported: A notification may carry zero or more actions. There is no enforced maximum at this stage.
• Actions included in WS payload: The full actions array is included in the notification.created WebSocket message.
• Actions included in REST response: The full actions array is included in all responses from GET /notifications.
• Unit tests: Cover validation of both action types, invalid type rejection, empty-array handling, and JSON round-trip for nested payload maps.

Definition of Done

• Code implemented following best practices.
• Unit tests written and passing.
• Code reviewed and approved.
• Merged into the main branch.
• Documentation updated (if applicable).
• Deployed to staging/production environment.

Assumptions and Constraints

• Assumption: The UI is responsible for executing api_call actions — the backend does not proxy or validate that the target path exists.
• Constraint: Action payloads are map[string]string only at this stage. No nested objects or typed values.

Dependencies

No response

Additional Notes

No response