Monitoring (R5.3): Betriebs-Alerts fuer Scheduler-/Queue-Ausfaelle

OperationalAlert loggt critical + Best-Effort-Mail an MONITORING_ALERT_EMAIL
(Fallback LEGAL_CONTACT_EMAIL, feature-flagged). Alle 6 Scheduler-Tasks mit
onFailure, Queue::failing-Listener; .env.example: LOG_STACK=daily als Prod-Soll.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/Mail/OperationalAlertMail.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Mail;
+
+use Illuminate\Bus\Queueable;
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+use Illuminate\Queue\SerializesModels;
+
+/**
+ * Betriebs-Alert an das Ops-Postfach (R5.3). Bewusst schlicht und ungebrandet:
+ * es geht um schnelle, verlässliche Zustellung, nicht um CI.
+ */
+class OperationalAlertMail extends Mailable
+{
+    use Queueable, SerializesModels;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $summary,
+        public readonly array $context = [],
+    ) {}
+
+    public function envelope(): Envelope
+    {
+        return new Envelope(
+            subject: '[Monitoring] '.$this->summary,
+        );
+    }
+
+    public function content(): Content
+    {
+        return new Content(
+            text: 'emails.monitoring.alert',
+            with: [
+                'summary' => $this->summary,
+                'context' => $this->context,
+                'appName' => config('app.name'),
+                'environment' => config('app.env'),
+            ],
+        );
+    }
+}

app/Providers/AppServiceProvider.php

@@ -23,6 +23,7 @@ use App\Observers\AdminPerformanceCacheObserver;
 use App\Services\Admin\AdminRequestPerformanceMetrics;
 use App\Services\Newsletter\NullNewsletterSyncClient;
 use App\Services\PressRelease\PressReleaseService;
+use App\Support\OperationalAlert;
 use Illuminate\Auth\Events\Login;
 use Illuminate\Auth\Events\Registered;
 use Illuminate\Auth\Events\Verified;
@@ -31,9 +32,11 @@ use Illuminate\Auth\Notifications\ResetPassword;
 use Illuminate\Auth\Notifications\VerifyEmail;
 use Illuminate\Database\Events\QueryExecuted;
 use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Queue\Events\JobFailed;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Facades\Gate;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Facades\URL;
 use Illuminate\Support\ServiceProvider;
 use Laravel\Cashier\Cashier;
@@ -91,6 +94,17 @@ class AppServiceProvider extends ServiceProvider
         Gate::define('access-admin', fn (User $user): bool => $user->canAccessAdmin());
         Gate::define('access-customer', fn (User $user): bool => $user->canAccessCustomer());
 
+        // Betriebs-Alert bei fehlgeschlagenem Queue-Job (R5.3): die KI-Jobs
+        // laufen auf der `classification`-Queue — ein stiller Stau in
+        // `failed_jobs` würde jede Einreichung in der Prüfung hängen lassen.
+        Queue::failing(function (JobFailed $event): void {
+            OperationalAlert::send("Queue-Job fehlgeschlagen: {$event->job->resolveName()}", [
+                'connection' => $event->connectionName,
+                'queue' => $event->job->getQueue(),
+                'exception' => $event->exception->getMessage(),
+            ]);
+        });
+
         // Registrierung → Verifizierungsmail; bestätigter Klick → Aktivierung.
         Event::listen(Registered::class, SendEmailVerificationNotification::class);
         Event::listen(Verified::class, ActivateUserAfterVerification::class);

app/Support/OperationalAlert.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Support;
+
+use App\Mail\OperationalAlertMail;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Mail;
+use Throwable;
+
+/**
+ * Zentrale Betriebs-Alerts (R5.3): meldet fehlgeschlagene Scheduler-Tasks und
+ * Queue-Jobs. Der Log-Eintrag (`critical`) ist die verlässliche Ebene und läuft
+ * immer; die Mail ist Best-Effort und darf den auslösenden Prozess nie mit in
+ * den Abgrund reißen (Mailserver down o. ä.).
+ */
+class OperationalAlert
+{
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public static function send(string $summary, array $context = []): void
+    {
+        Log::critical('[monitoring] '.$summary, $context);
+
+        if (! config('monitoring.alerts.enabled')) {
+            return;
+        }
+
+        $recipient = config('monitoring.alerts.mail_to');
+
+        if (empty($recipient)) {
+            return;
+        }
+
+        try {
+            Mail::to($recipient)->send(new OperationalAlertMail($summary, $context));
+        } catch (Throwable $e) {
+            Log::error('[monitoring] Alert-Mail konnte nicht versendet werden.', [
+                'summary' => $summary,
+                'error' => $e->getMessage(),
+            ]);
+        }
+    }
+}