Stop alert webhooks putting raw transcripts in a third-party channel

Alert dispatch attached a 200-character raw transcript snippet to the
alert_events document and POSTed the same text to the org's Discord
webhook, with no redaction of any kind. Board minutes #42 ratified that
person names are suppressed on every surface until E&O is bound, and a
Discord channel is the least recoverable surface there is: once the text
lands we do not own it, cannot unsend it, and cannot audit who read it.

Raw transcript text now requires two independent gates, both closed by
default:

  1. alert_transcript_snippet_enabled -- an operator switch in config,
     set from the environment.
  2. alert_snippet_opt_in on the org document -- the customer's own
     explicit consent.

Gate 1 is not redundant. The frontend reads and writes Firestore directly
from the browser, so the org flag alone would let an org owner opt
themselves into receiving person names lifted from live public-safety
traffic. Capability is the operator's to grant; consent is the org's.

The gate fails closed on a Firestore error and on a call with no org
(a pre-tenancy node that has not been backfilled) -- a less informative
alert is cheap, an unrecallable disclosure is not. Alerting itself is
unchanged: the webhook still fires and still names the rule, the
talkgroup and the matched keywords.

This does not wait on the Gate B3 redactor (#43, 2026-09-30). The
snippet was a convenience field and needed no redactor to withhold.

Tests assert the person name in a sample transcript does not appear in
either the outbound payload or the Firestore write, in every combination
of the two gates.

Closes server-26#85. Refs #42, #43, #48.

drb-c2-core/app/internal/alerter.py

@@ -6,11 +6,15 @@ talkgroup ID, tags, and transcript.  On a match:
   1. Creates an AlertEvent document in Firestore.
   2. Optionally POSTs a Discord webhook message if the rule has one configured.
 
+Raw transcript text is withheld from both by default -- see _snippet_allowed
+and server-26#85.
+
 Never raises — failures are logged as warnings so the pipeline always completes.
 """
 import uuid
 from datetime import datetime, timezone
 from typing import Optional
+from app.config import settings
 from app.internal.logger import logger
 from app.internal import firestore as fstore
 
@@ -47,13 +51,17 @@ async def check_and_dispatch(
         logger.warning(f"Alerter: could not load rules: {e}")
         return
 
+    # Loop-invariant: every rule here belongs to the same org, so the opt-in is
+    # resolved once rather than per match.
+    snippet_allowed = await _snippet_allowed(org_id)
+
     for rule in rules:
         matched_keywords = _match_rule(rule, talkgroup_id, tags, transcript)
         if not matched_keywords:
             continue
 
         alert_id = str(uuid.uuid4())
-        snippet = _snippet(transcript)
+        snippet = _snippet(transcript) if snippet_allowed else None
         now = datetime.now(timezone.utc).isoformat()
         event = {
             "alert_id": alert_id,
@@ -85,6 +93,43 @@ async def check_and_dispatch(
             await _post_webhook(webhook_url, rule.get("name", ""), talkgroup_name, matched_keywords, snippet)
 
 
+async def _snippet_allowed(org_id: Optional[str]) -> bool:
+    """
+    Whether raw transcript text may be attached to an alert (server-26#85).
+
+    Two gates, both of which must be open:
+
+    1. ``settings.alert_transcript_snippet_enabled`` -- the operator switch,
+       default False, set from the environment and unreachable from the app.
+    2. ``alert_snippet_opt_in`` on the org document -- the customer's own
+       explicit, contractual opt-in.
+
+    Gate 1 exists because gate 2 alone is not a real control: the frontend
+    reads and (per the Firestore rules, not ``auth.py``) can write org state
+    directly from the browser, so an org owner could otherwise opt themselves
+    into receiving person names lifted from live public-safety traffic. Board
+    minutes #42 suppress names on every surface until E&O is bound.
+
+    Fails CLOSED on any error, and on a call with no org (a pre-tenancy node
+    that has not been backfilled), because the cost of wrongly withholding a
+    snippet is a less informative alert and the cost of wrongly emitting one
+    is unrecallable disclosure to a third party.
+    """
+    if not settings.alert_transcript_snippet_enabled:
+        return False
+    if not org_id:
+        return False
+    try:
+        org = await fstore.doc_get("organizations", org_id)
+    except Exception as e:
+        logger.warning(
+            f"Alerter: could not read snippet opt-in for org={org_id}, "
+            f"withholding transcript: {e}"
+        )
+        return False
+    return bool((org or {}).get("alert_snippet_opt_in"))
+
+
 def _match_rule(
     rule: dict,
     talkgroup_id: Optional[int],