fix(api): harden webhook email fallback

Regenerate plain text with the real payload if Hermes no longer
preserves the formatting sentinel. Document the escaped template.HTML
conversion for G203.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 48f6d946-ae22-4440-b7a1-44e939419b11

Author: AchoArnold

api/pkg/emails/event_payload_formatter.go

@@ -23,7 +23,7 @@ func formatEventPayload(payload string) (string, template.HTML) {
 		content = highlightEventPayloadJSON(formattedPayload)
 	}
 
-	// Every payload token is escaped before this trusted wrapper is constructed.
+	// #nosec G203 -- every dynamic payload token is escaped before the static wrapper is added.
 	richPayload := template.HTML(`<pre style="` + eventPayloadCodeBlockStyle + `">` + content + `</pre>`)
 	return formattedPayload, richPayload
 }

api/pkg/emails/hermes_notification_email_factory.go

@@ -123,12 +123,14 @@ func (factory *hermesNotificationEmailFactory) WebhookSendFailed(user *entities.
 		return nil, stacktrace.Propagate(err, "cannot generate html email")
 	}
 
-	text, err := factory.generator.GeneratePlainText(email)
+	eventPayloadEntryIndex := len(email.Body.Dictionary) - 1
+	text, err := generateWebhookSendFailedPlainText(func(value string) (string, error) {
+		email.Body.Dictionary[eventPayloadEntryIndex].Value = value
+		return factory.generator.GeneratePlainText(email)
+	}, formattedPayload)
 	if err != nil {
 		return nil, stacktrace.Propagate(err, "cannot generate text email")
 	}
-	// Hermes/html2text collapses dictionary whitespace, so restore the payload after plain-text generation.
-	text = replaceWebhookSendFailedEventPayloadPlaceholder(text, formattedPayload)
 
 	return &Email{
 		ToEmail: user.Email,
@@ -138,6 +140,21 @@ func (factory *hermesNotificationEmailFactory) WebhookSendFailed(user *entities.
 	}, nil
 }
 
+func generateWebhookSendFailedPlainText(generate func(string) (string, error), formattedPayload string) (string, error) {
+	text, err := generate(webhookSendFailedEventPayloadPlaceholder)
+	if err != nil {
+		return "", err
+	}
+
+	if strings.Contains(text, webhookSendFailedEventPayloadPlaceholder) {
+		// Hermes/html2text collapses dictionary whitespace, so restore the payload after plain-text generation.
+		return replaceWebhookSendFailedEventPayloadPlaceholder(text, formattedPayload), nil
+	}
+
+	// Preserve the real payload if a Hermes change stops carrying the placeholder through unchanged.
+	return generate(formattedPayload)
+}
+
 func replaceWebhookSendFailedEventPayloadPlaceholder(text string, formattedPayload string) string {
 	before, after, found := strings.Cut(text, webhookSendFailedEventPayloadPlaceholder)
 	if !found {

api/pkg/emails/hermes_notification_email_factory_test.go

@@ -50,6 +50,7 @@ func TestWebhookSendFailedFormatsOnlyEventPayload(t *testing.T) {
 	assert.Contains(t, email.Text, `"retry": false`)
 	assert.NotContains(t, email.Text, "<pre")
 	assert.NotContains(t, email.Text, webhookSendFailedEventPayloadPlaceholder)
+	assert.NotContains(t, email.HTML, webhookSendFailedEventPayloadPlaceholder)
 }
 
 func TestWebhookSendFailedPreservesNonJSONEventPayload(t *testing.T) {
@@ -76,6 +77,24 @@ func TestWebhookSendFailedPreservesNonJSONEventPayload(t *testing.T) {
 	assert.Contains(t, email.Text, "line one\n  line two")
 }
 
+func TestGenerateWebhookSendFailedPlainTextFallsBackToFormattedPayload(t *testing.T) {
+	formattedPayload := "{\n  \"message\": \"hello\"\n}"
+	values := make([]string, 0, 2)
+	generate := func(value string) (string, error) {
+		values = append(values, value)
+		if len(values) == 1 {
+			return "plain text without the placeholder", nil
+		}
+		return value, nil
+	}
+
+	text, err := generateWebhookSendFailedPlainText(generate, formattedPayload)
+
+	require.NoError(t, err)
+	assert.Equal(t, formattedPayload, text)
+	assert.Equal(t, []string{webhookSendFailedEventPayloadPlaceholder, formattedPayload}, values)
+}
+
 func TestReplaceWebhookSendFailedEventPayloadPlaceholder(t *testing.T) {
 	tests := []struct {
 		name             string