If you want to have zero downtime, you can scale the container to two and if everything succeeded just kill the old container. (Need reverse proxy with balancing like caddy)

Sorry my bad, but why does it matter as long as you secure any channel?

And how do you want to send alerts with authelia in front?

Btw are you aware of authentication within ntfy? https://reddit.com/r/selfhosted/s/1IoWDROCD5