feat: Home Assistant settings UI + fix channels.json

notifications.html: add Home Assistant section with two collapsible
blocks — Connection (HA URL + Long-Lived Access Token) and Inbound
webhook (webhook ID with endpoint URL hint showing the username).
Token field uses keep-existing pattern (blank = no change).

settings.py: wire ha_url, ha_token, ha_webhook_id through
_notifications_page() template substitution and save_notifications()
POST handler. Preserves existing HA config fields (persona, tier,
role, tools) on save.

TODO__Agents.md: add Home Assistant integration planning section
(event design, richer payload template, HA API tools).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

documentation/TODO__Agents.md

@@ -116,6 +116,29 @@ Inara reaches out on her own initiative via NC Talk, Google Chat, email, or brow
 - [x] `POST /api/push/test` + `POST /api/push/reminders/check` — on-demand test endpoints
 - [x] `push_utils.py` — fixed `pywebpush` 2.x key deserialisation (use `Vapid.from_pem()` instead of passing PEM string)
 
+### [Channel] Home Assistant integration — design & tools
+Inara can already receive HA events via `POST /webhook/ha/{username}/{webhook_id}` and
+respond via web push. Next steps are deciding what events to send and giving Inara the
+ability to act on HA via the REST API.
+
+- [ ] **Event design** — decide which HA events are worth routing to Inara (security,
+      climate thresholds, low battery, unexpected device state). Avoid flooding with
+      high-frequency sensor polling. Per-automation `"tools": true/false` to choose
+      notify-only vs. agentic response.
+- [ ] **Richer payload template** — update `rest_command` in HA to include
+      `trigger.to_state.attributes`, `area_name`, and `previous_state` so Inara gets
+      full device context automatically.
+- [ ] **HA API tools** — add dedicated orchestrator tools in `cortex/tools/homeassistant.py`:
+      - `ha_get_state(entity_id)` — current state + attributes of any entity
+      - `ha_call_service(domain, service, data)` — turn on lights, set HVAC, lock doors, etc.
+      - `ha_get_states(area=None, domain=None)` — list states with optional filter
+      - Auth via Long-Lived Access Token stored in `channels.json` under `homeassistant.token`
+      - HA URL from `channels.json` under `homeassistant.url`
+- [ ] **Store HA config in channels.json** — add `url` and `token` fields alongside
+      `webhook_id` so tools can reach the HA REST API (`https://ha.dgrzone.com`)
+- [ ] **`ha_call_service` confirm-required** — destructive actions (locks, alarms) should
+      go through the confirmation gate
+
 ### [UX] Session delete confirmation
 The session delete button in the sidebar needs a confirmation step before firing — currently
 it deletes immediately on click with no undo. A simple `confirm()` dialog or an inline