WP-20/21: contract and failing tests for vulnerability management

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/application/src/settings_service.rs

@@ -6,6 +6,8 @@ use domain::settings::{SmtpSettings, KEY_SMTP, SECRET_KEYS};
 use domain::DomainError;
 
 use crate::scheduler::validate_cron;
+use crate::vuln_service::{DEFAULT_NOTIFY_MIN_SEVERITY, KEY_NOTIFY_MIN_SEVERITY};
+use domain::vuln::Severity;
 
 pub struct SettingsService {
     repo: Arc<dyn SettingsRepository>,
@@ -104,6 +106,20 @@ impl SettingsService {
     }
 }
 
+impl SettingsService {
+    pub async fn notify_min_severity(&self) -> Result<Severity, DomainError> {
+        Ok(self
+            .get(KEY_NOTIFY_MIN_SEVERITY)
+            .await?
+            .map(|s| Severity::parse(&s))
+            .unwrap_or(DEFAULT_NOTIFY_MIN_SEVERITY))
+    }
+
+    pub async fn set_notify_min_severity(&self, severity: Severity) -> Result<(), DomainError> {
+        self.set(KEY_NOTIFY_MIN_SEVERITY, severity.as_str()).await
+    }
+}
+
 fn schedule_key(kind: JobKind) -> String {
     format!("schedule.{}", kind.as_str())
 }