feat(tra-1040): route preview org-lifecycle notices to a single address

argocd/root/templates/trakrf-backend.yaml

@@ -30,6 +30,13 @@
 {{- if $cfg.logLevel }}
 {{- $base = printf "%s  runtimeLogLevel: %q\n" $base $cfg.logLevel }}
 {{- end }}
+{{- /* Per-env org-lifecycle notification address (TRA-1040). Maps to the chart's
+       config.orgCreateNotifyAddr → ORG_CREATE_NOTIFY_ADDR. Preview pins one
+       operator address so e2e test-org churn stops paging every superadmin;
+       prod omits it and keeps the default fan-out. Also a config sub-key. */ -}}
+{{- if $cfg.orgCreateNotifyAddr }}
+{{- $base = printf "%s  orgCreateNotifyAddr: %q\n" $base $cfg.orgCreateNotifyAddr }}
+{{- end }}
 {{- if $cfg.imageTag }}
 {{- $base = printf "%simage:\n  tag: %q\n" $base $cfg.imageTag }}
 {{- end }}

argocd/root/values.yaml

@@ -40,6 +40,11 @@ namespaces:
 #                                is empty/missing in this env. preview=true; prod
 #                                stays false until its key is injected (an active
 #                                guard blocks live prod syncs). Default off.
+# orgCreateNotifyAddr          — TRA-1040: backend ORG_CREATE_NOTIFY_ADDR. Routes
+#                                org signup/create/delete notices to this single
+#                                address and skips the all-superadmins fan-out.
+#                                preview=one operator address; prod omits it (the
+#                                fan-out is the intended prod behavior).
 # imageTag                     — trakrf-backend image tag override. Empty falls
 #                                back to chart default (helm/trakrf-backend/values-<cluster>.yaml).
 #                                On GKE BOTH envs are image-updater-tracked
@@ -93,6 +98,10 @@ envs:
     # per-message ingest firehose into Cloud Logging. Pin info (TRA-974); prod
     # omits this and keeps its APP_ENV→warn default.
     logLevel: info
+    # TRA-1040: preview's e2e org-creation firehose notified every active
+    # superadmin. Routing all three org-lifecycle notices to one address silences
+    # the churn for everyone else. Prod omits this key → default fan-out.
+    orgCreateNotifyAddr: mike@kwyk.net
     dbCluster:
       enabled: true
       fullnameOverride: trakrf-db-preview

helm/trakrf-backend/templates/configmap.yaml

@@ -12,6 +12,12 @@ data:
   # Emitted only when set, so envs that omit it (prod) keep their APP_ENV→warn
   # default and render no LOG_LEVEL key. Set per-env via the root app (preview→info).
   LOG_LEVEL: {{ . | quote }}
+{{- end }}
+{{- with .Values.config.orgCreateNotifyAddr }}
+  # TRA-1040: routes org create/signup/delete notices to one operator address and
+  # skips the all-superadmins fan-out. Emitted only when set — envs that omit it
+  # (prod) render no key and keep the default fan-out.
+  ORG_CREATE_NOTIFY_ADDR: {{ . | quote }}
 {{- end }}
   SERVICE_NAME: {{ .Values.config.serviceName | quote }}
   BACKEND_CORS_ORIGIN: {{ .Values.config.corsOrigin | quote }}

helm/trakrf-backend/values.yaml

@@ -144,6 +144,12 @@ config:
   # inherit the backend's APP_ENV-based default (production→warn, dev/preview→
   # debug). Set per-env (preview→info) to pin a level.
   runtimeLogLevel: ""
+  # orgCreateNotifyAddr → ORG_CREATE_NOTIFY_ADDR (TRA-1040, platform PR #524).
+  # When set, all three org-lifecycle notices (self-service signup, internal
+  # create, delete) route to this single address instead of fanning out to every
+  # active superadmin. Empty = unset = default fan-out (prod's behavior). Set
+  # per-env by the root chart (preview only) to silence e2e test-org churn.
+  orgCreateNotifyAddr: ""
   serviceName: trakrf-backend
   corsOrigin: ""
   jwtExpirationSeconds: "3600"