feat: show notification source (agent vs SAC) in alerts and reports

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_telegram_templates.py

@@ -65,6 +65,26 @@ def test_rdp_success_template():
     text = format_event_telegram_html(event)
     assert "УСПЕШНЫЙ" in text
     assert "Сеть/RDP" in text
+    assert "📡 Оповещение: агент" in text
+
+
+def test_event_telegram_includes_sac_source_for_sac_daily_report():
+    host = Host(hostname="h1", display_name="H1", os_family="linux", product="ssh-monitor")
+    event = Event(
+        event_id="00000000-0000-4000-8000-000000000504",
+        host_id=1,
+        host=host,
+        occurred_at=datetime(2026, 5, 29, 9, 0, tzinfo=timezone.utc),
+        category="report",
+        type="report.daily.ssh",
+        severity="info",
+        title="Отчёт",
+        summary="short",
+        details={"generated_by": "sac", "report_body": "📊 ЕЖЕДНЕВНЫЙ ОТЧЕТ SSH МОНИТОРИНГА\nline"},
+        payload={},
+    )
+    text = format_event_telegram_html(event)
+    assert "📡 Оповещение: SAC (Security Alert Center)" in text
 
 
 def test_rdp_shadow_control_template():