feat: SAC daily reports from DB aggregation (notif-32)

- Aggregate report.daily.ssh/rdp from 24h ingest; job and systemd timer

- notify_daily_report bypasses NOTIFY_MIN_SEVERITY; ingest routes agent reports

- HTML templates, env SAC_DAILY_REPORT_*, docs and tests (56 cases)

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/api/v1/events.py

@@ -17,7 +17,9 @@ from app.schemas.list_models import EventDetail, EventListResponse, EventSummary
 from app.services.ingest import ingest_event
 from app.services.problems import maybe_create_problem
 from app.services.schema_validate import validate_event_payload
-from app.services.notify_dispatch import notify_event, notify_problem
+from app.services.notify_dispatch import notify_daily_report, notify_event, notify_problem
+
+DAILY_REPORT_EVENT_TYPES = frozenset({"report.daily.ssh", "report.daily.rdp"})
 
 router = APIRouter(prefix="/events", tags=["events"])
 logger = logging.getLogger("sac.ingest")
@@ -64,7 +66,10 @@ def post_event(
     problem_created = False
     if created:
         problem, problem_created = maybe_create_problem(db, event)
-        notify_event(event, db=db)
+        if event.type in DAILY_REPORT_EVENT_TYPES:
+            notify_daily_report(event, db=db)
+        else:
+            notify_event(event, db=db)
         if problem is not None and problem_created:
             notify_problem(problem, event, db=db)
         logger.info("ingest created event_id=%s type=%s host_id=%s", event.event_id, event.type, event.host_id)