Stop alert webhooks putting raw transcripts in a third-party channel

Alert dispatch attached a 200-character raw transcript snippet to the
alert_events document and POSTed the same text to the org's Discord
webhook, with no redaction of any kind. Board minutes #42 ratified that
person names are suppressed on every surface until E&O is bound, and a
Discord channel is the least recoverable surface there is: once the text
lands we do not own it, cannot unsend it, and cannot audit who read it.

Raw transcript text now requires two independent gates, both closed by
default:

  1. alert_transcript_snippet_enabled -- an operator switch in config,
     set from the environment.
  2. alert_snippet_opt_in on the org document -- the customer's own
     explicit consent.

Gate 1 is not redundant. The frontend reads and writes Firestore directly
from the browser, so the org flag alone would let an org owner opt
themselves into receiving person names lifted from live public-safety
traffic. Capability is the operator's to grant; consent is the org's.

The gate fails closed on a Firestore error and on a call with no org
(a pre-tenancy node that has not been backfilled) -- a less informative
alert is cheap, an unrecallable disclosure is not. Alerting itself is
unchanged: the webhook still fires and still names the rule, the
talkgroup and the matched keywords.

This does not wait on the Gate B3 redactor (#43, 2026-09-30). The
snippet was a convenience field and needed no redactor to withhold.

Tests assert the person name in a sample transcript does not appear in
either the outbound payload or the Firestore write, in every combination
of the two gates.

Closes server-26#85. Refs #42, #43, #48.

drb-c2-core/app/config.py

@@ -61,6 +61,15 @@ class Settings(BaseSettings):
     # against the talkgroup's own anchor instead of stuffing every road in town
     # into the prompt, so cost scales with location nouns rather than call volume.
     place_verification_enabled: bool = True
+    # Raw transcript text in alert payloads (server-26#85). Default CLOSED.
+    # Board minutes #42 suppress person names on every surface until E&O is
+    # bound, and an alert webhook is the least recoverable surface there is:
+    # once the text is in a Discord channel we do not own it, cannot unsend
+    # it, and cannot audit who read it. This switch is the operator-level
+    # gate and is deliberately NOT reachable from the app -- the per-org
+    # opt-in alone would let an org owner self-serve their way to somebody
+    # else's PII. Both gates must be open before any snippet leaves.
+    alert_transcript_snippet_enabled: bool = False
     place_verify_max_per_call: int = 3
     # How close a candidate has to sound before it may rewrite a transcript.
     # Below this, Places Text Search will confidently hand back the nearest