Every Kuma monitor, group or child, carried the default "email" notification, so one outage sent a down and an up mail per monitor. - New cluster-scoped CRD KumaNotification (type smtp): from/to in the spec, host/port/username/password from a Secret read uncached. kuma-sync adopts the Kuma notification of the same name, keeps it isDefault=false and reverts drift. - KumaMonitor gains spec.notificationRefs. A monitor attaches only the notifications it references; none means none. The default-notification attachment is removed. - KumaNotification "email" (uptime@renner.uno -> admin@renner.uno) with ExternalSecret kuma-sync-smtp from homelab/infrastructure/uptime-kuma/smtp and a Role granting get on that one Secret. No monitor references it. - kuma-setup.js no longer creates the notification; the uptime-kuma role and the uptime-kuma-vps policy drop the SMTP credentials (policy must be re-applied by hand). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>