feat: extend systemd-email-notify module with optional ntfy support

Add configurable ntfy options (tokenFile, url, topic) to the shared
emailOnFailure module. When tokenFile is set, a ntfy-failure@ template
service is added alongside the existing email notifications. Systems
without ntfy configured are unaffected.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

systems/x86_64-linux/mx/ntfy.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, ... }:
 {
   services.ntfy-sh = {
     enable = true;
@@ -19,30 +19,9 @@
     };
   };
 
-  # Notify via ntfy on any service failure (alongside email)
-  systemd.services."ntfy-failure@" = {
-    description = "Send ntfy notification on service failure";
-    onFailure = lib.mkForce [ ];
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = pkgs.writeShellScript "ntfy-failure-notify" ''
-        TOKEN=$(cat ${config.sops.secrets.ntfy.path})
-        UNIT="$1"
-        ${pkgs.curl}/bin/curl -s \
-          -H "Authorization: Bearer $TOKEN" \
-          -H "Title: Service failed: $UNIT" \
-          -H "Priority: urgent" \
-          -H "Tags: rotating_light" \
-          -d "$(systemctl status --full "$UNIT" 2>&1 | head -40)" \
-          http://127.0.0.1:2586/alerts
-      '';
-    };
-    scriptArgs = "%i";
-  };
-
-  systemd.services = lib.mkOption {
-    type = lib.types.attrsOf (lib.types.submodule {
-      config.onFailure = [ "ntfy-failure@%n.service" ];
-    });
+  metacfg.emailOnFailure.ntfy = {
+    tokenFile = config.sops.secrets.ntfy.path;
+    url = "http://127.0.0.1:2586";
+    topic = "alerts";
   };
 }