The backup security hardening placed ConfigKey.BREVO in adminOnlyConfigKeys, causing non-admin users (walk leaders) to receive a 403 when loading the mail config. The frontend silently fell back to defaults with walkNotificationConfigId null, so the notification system correctly blocked the save — but for the wrong reason: the config existed, it just wasn't being served to them.