Add a notice registry and System Health tab (#24178)

* add a notice registry and System Health tab

Problems Frigate detects on its own (ffmpeg crash loops, stuck detectors, failed model downloads, recordings deleted before their retention period) only ever existed as log lines. This adds a `NoticeRegistry` in the main process backed by two tables, an `update_notice` IPC topic so producers in other processes can reach it through the dispatcher, an admin-only API and websocket topic, and a Health tab that lists them. Kinds declare their own mode, severity, and category in one place: state notices are resolved by their producer, event notices are dismissed by the user.

* treat a prerelease as behind its final release

* fix notices clearing early

* rename menu items and update docs

* don't resolve the update notice on a failed version lookup

frigate/comms/ws.py

@@ -31,6 +31,7 @@ from frigate.const import (
     UPDATE_EMBEDDINGS_REINDEX_PROGRESS,
     UPDATE_EVENT_DESCRIPTION,
     UPDATE_MODEL_STATE,
+    UPDATE_NOTICE,
     UPDATE_REVIEW_DESCRIPTION,
     UPSERT_REVIEW_SEGMENT,
 )
@@ -56,6 +57,7 @@ _WS_BLOCKED_TOPICS = frozenset(
         UPDATE_EMBEDDINGS_REINDEX_PROGRESS,
         UPDATE_BIRDSEYE_LAYOUT,
         UPDATE_AUDIO_TRANSCRIPTION_STATE,
+        UPDATE_NOTICE,
     }
 )
 
@@ -158,6 +160,16 @@ _WS_UNRESTRICTED_ONLY_TOPICS = frozenset(
     }
 )
 
+# Topics only an admin connection may receive. unrestricted_only is not
+# enough: the built-in viewer role has an empty camera allow-list, which the
+# camera policy treats as full access, while the REST side of these topics
+# is admin-only.
+_WS_ADMIN_ONLY_TOPICS = frozenset(
+    {
+        "notices",
+    }
+)
+
 # Topics whose payload (parsed as JSON) names a single owning camera at the
 # given key path. Used to scope events, reviews, triggers, etc.
 _WS_PAYLOAD_CAMERA_TOPICS: dict[str, tuple[str, ...]] = {
@@ -280,6 +292,7 @@ def _classify_outbound(
       - "global"             : send to every authenticated client
       - "drop"               : send to nobody (fail-closed for unknowns)
       - "unrestricted_only"  : send only to admin/full-access roles
+      - "admin_only"         : send only to connections with the admin role
       - "camera"             : extra is the owning camera name
       - "payload_camera"     : extra is the JSON key path to the camera name
       - "reshape_by_camera_key"
@@ -288,6 +301,8 @@ def _classify_outbound(
     """
     if topic in _WS_GLOBAL_OUTBOUND_TOPICS:
         return ("global", None)
+    if topic in _WS_ADMIN_ONLY_TOPICS:
+        return ("admin_only", None)
     if topic in _WS_UNRESTRICTED_ONLY_TOPICS:
         return ("unrestricted_only", None)
     if topic in _WS_RESHAPE_BY_CAMERA_KEY_TOPICS:
@@ -391,6 +406,9 @@ def _materialize_for_ws(
     if kind == "unrestricted_only":
         return full_message if _ws_is_unrestricted(ws, config) else None
 
+    if kind == "admin_only":
+        return full_message if "admin" in _ws_valid_roles(ws, config) else None
+
     if kind == "camera":
         return full_message if ws_has_camera_access(ws, extra, config) else None