Create or Update Email Notification

What it does

Creates a new email notification when notification_id is omitted, or updates an existing one (verified to belong to the given form_id, so a foreign id can never fork a new notification onto the wrong form) when it is supplied. On update, only the fields passed are changed; everything else is preserved via a read-modify-merge-write inside a row-locked transaction. subject and message are required to create, and message is HTML that is sanitized on save through the same path the admin Email Notifications screen uses (SettingsService::store). The recipient is set via send_to_type: "email" with send_to_email (a fixed address or a {smartcode}), or "field" with send_to_field (a form field key). It is annotated destructive rather than merely a write because repointing sendTo silently redirects every future submission of the form to a new mailbox with no signal anywhere in the admin UI — the dry-run preview spells out the old and new recipient explicitly so an operator can catch a redirect before it happens, and the confirm_token binds the resulting notification content so it can't be replayed to smuggle a different recipient onto the same edit.