fix: read enabled checkbox correctly when paired with hidden=0 sibling

The notification channel form has a <input hidden name=enabled value=0>
plus a <input checkbox name=enabled value=1> so unchecking the box
still submits 'enabled=0' (otherwise the field would just be absent).
But Go's url.Values.Get returns the FIRST value, so even when the
checkbox is ticked the handler read '0' and persisted enabled=false.

Scan r.PostForm["enabled"] for any '1' instead. Caught during the
sweep — all three test channels saved with enabled=0 even though
the toggle visually rendered ON.

internal/server/http/ui_notifications.go

@@ -144,13 +144,26 @@ func (s *Server) decryptChannelConfig(ch store.NotificationChannel, dst any) err
 	return json.Unmarshal(plain, dst)
 }
 
+// formHasValue reports whether vals contains want. Used for hidden+checkbox
+// pairs (e.g. <input hidden name=x value=0> + <input checkbox name=x value=1>)
+// where r.PostForm.Get returns the first ("0") even when the checkbox is
+// ticked, so we have to scan the slice instead.
+func formHasValue(vals []string, want string) bool {
+	for _, v := range vals {
+		if v == want {
+			return true
+		}
+	}
+	return false
+}
+
 // formFromRequest parses the common + per-kind fields from a POST form.
 // The caller must have already called r.ParseForm().
 func formFromRequest(r *stdhttp.Request) *notificationForm {
 	f := &notificationForm{
 		Kind:            strings.TrimSpace(r.PostForm.Get("kind")),
 		Name:            strings.TrimSpace(r.PostForm.Get("name")),
-		Enabled:         r.PostForm.Get("enabled") == "1",
+		Enabled:         formHasValue(r.PostForm["enabled"], "1"),
 		DefaultPriority: strings.TrimSpace(r.PostForm.Get("default_priority")),
 
 		WebhookURL:         strings.TrimSpace(r.PostForm.Get("webhook_url")),