Summary

Adds an Opsgenie notification adapter with parity to the existing Slack/Discord/Telegram/PagerDuty pattern (plan 26):

• Pure adapter (apps/dashboard/src/lib/health/adapters/opsgenie.ts): buildOpsgenieBody(payload) builds an Opsgenie Alert API v2 create-alert body — severity → priority (critical→P1, warning→P2), a stable alias (chmonitor:{hostId}:{metric}) so repeat firings collapse to one alert, host+metric tags, string-only details, runbook links in description. opsgenieAdapter.detect matches api.opsgenie.com / api.eu.opsgenie.com. No network/auth in this layer.
• Registry: opsgenieAdapter registered in adapters/index.ts (ADAPTERS, before the generic fallback); types/functions re-exported.
• Server config: getServerOpsgenieConfig() in server-alert-config.ts reads HEALTH_ALERT_OPSGENIE_API_KEY (empty ⇒ null, fail-open) and HEALTH_ALERT_OPSGENIE_REGION (us/eu, default us). AlertSettings shape unchanged.
• Dispatch (opsgenie-dispatch.ts): POSTs create on trigger / closes the alias on recovery, with the GenieKey auth header and region-correct base URL, through the same SSRF guard (validateHostUrl) other outbound fetches use. Never throws — fails open into the sweep.
• Sweep wiring (server-sweep.ts): the per-finding dedup decision now fans out to webhook and Opsgenie independently; each channel's failure is isolated, and "notified" is only persisted once at least one channel delivered (so a fully-failed sweep still retries).
• Settings UI: health-settings-dialog.tsx gets an Opsgenie section with a configured/region status badge and a "Send test" button, backed by a new GET/POST /api/v1/health/opsgenie-test route (POST write-gated like the webhook proxy).

Note on the settings-UI interpretation

The plan's done-criteria says "Opsgenie key field." The Opsgenie API key
is documented (server-alert-config.ts) as a server-only secret that must
never round-trip to the browser — a localStorage-backed key input (like the
webhook URL field) would either be non-functional or a secret-leak path given
that design. Implemented instead as a read-only configured/region status +
a server-side test-send button that exercises the server's own env-configured
key. Flagging this explicitly rather than silently deviating from the
checklist wording.

Note on server-sweep.ts

This branch also carries the (uncommitted, pre-existing) Opsgenie dispatch
wiring into runHealthSweep — split into its own commit since other agents
are working on server-sweep.ts / server-alert-config.ts in parallel for
plan 30's routing model. Expect a rebase.

Known coverage gap

runHealthSweep's new if (opsgenieConfig) fan-out branch isn't covered by
an integration test — health-sweep.test.ts only tests CRON_SECRET auth,
and the pre-existing webhook fan-out isn't integration-tested there either.
The Opsgenie dispatch unit itself is fully covered by opsgenie-dispatch.test.ts.

Verification

$ cd apps/dashboard && bun run type-check
$ tsc --noEmit
EXIT:0

$ cd apps/dashboard && bun run build
... (prerender all routes) ...
EXIT:0

$ cd apps/dashboard && bun test src/lib/health/adapters --isolate
37 pass, 0 fail, 6 snapshots, 95 expect() calls

$ cd apps/dashboard && bun test src/lib/health/server-alert-config.test.ts --isolate
18 pass, 0 fail, 21 expect() calls

$ bun run lint   # (root — `cd apps/dashboard && bun run lint` has no such script;
                 #  root biome lint covers the whole monorepo including apps/dashboard)
Checked 1945 files in 1060ms. No fixes applied.

Additional tests run (not in the plan's block, covering the new UI/route + dispatch wiring):

• bun test src/routes/api/v1/health/opsgenie-test.test.ts --isolate — 6 pass
• bun test src/lib/health/opsgenie-dispatch.test.ts src/routes/api/cron/__tests__/health-sweep.test.ts --isolate — 18 pass

Test plan

• type-check, build, targeted unit tests, lint all green
• buildOpsgenieBody snapshot + severity/alias/tags/details/description tests
• getServerOpsgenieConfig env-reader tests (empty/whitespace/region normalization)
• Opsgenie dispatch transport tests (create/close routing, SSRF guard, auth header, failure handling)
• New settings-route tests (status GET, auth-gated test-send POST, 400/502 paths)
• Manual: set HEALTH_ALERT_OPSGENIE_API_KEY locally and confirm "Send test" creates a real Opsgenie alert (not run — no sandbox API key available)

https://claude.ai/code/session_01XpfaNdJZh4Rtr6cQm4DYqa