Phase 7: notify and send via Apprise (Email + WhatsApp)

The morning briefs go out through the house Apprise API on `.35:8210`: one
brief per boy and one combined brief to Jo and Sam (FR-9, FR-14). The service
names an Apprise tag (`harry_email`, `joanna_whatsapp`, ...) and never holds an
address, a phone number or an SMTP password (AGENTS.md §10 rule 3).

- internal/apprise: keyed and stateless client, tag filtering, and error
  redaction so nothing sensitive reaches a log, a row or a screen.
- internal/brief: builds the per-boy and the combined brief, delivers on email
  and WhatsApp, records every attempt in `notifications` (migration 004 adds
  scope, channel, tag, ok and error) and fails loudly.
- Send panel (§5 screen 4): recipients, channels, an exact preview, Send now,
  plus the Send action on a stored draft (FR-10). The dashboard shows a
  Morning briefs banner and the Sends list.
- POST /notify/morning: the bearer-token endpoint the 6:00am n8n schedule
  calls. 207 when a channel or a scan failed; `dry_run=1` checks the wiring
  without messaging the family.
- scripts/morning-brief.sh: scan both children, then send. It is the n8n job;
  deploy/n8n-morning-brief.json is the ready-to-import workflow (06:00 daily).
- FR-12: a failed scan is never "nothing due" -- the brief says so, and the run
  exits non-zero. A failed delivery is recorded with no sent_at.
- The long no-due-date tail is capped in the sent brief so it stays brief
  (§10 rule 6); overdue work is never capped.

Verified live: 8 deliveries recorded (4 email, 4 WhatsApp) with HTTP 200 and
sent_at, and the endpoint answers 401/200/207 as documented. Evidence in
docs/phase-7-notify-notes.md.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Makefile

@@ -1,5 +1,5 @@
-IMAGE ?= compass-teams-nhs/school:0.4.0-phase6
-BUILD_VERSION ?= 0.4.0-phase6
+IMAGE ?= compass-teams-nhs/school:0.5.0-phase7
+BUILD_VERSION ?= 0.5.0-phase7
 
 # Parse options (see scripts/parse-compass.sh).
 CHILD ?= Harry
@@ -9,6 +9,9 @@ CLASSIFY ?= auto
 # Scan target: 'all' scans every child; set SCAN_CHILD=Harry to narrow it.
 SCAN_CHILD ?= all
 
+# Notify options (see scripts/morning-brief.sh and school notify run).
+NOTIFY_ARGS ?=
+
 # Bounded docker helper for the Go toolchain. The container runs as the current
 # user, so the repository and the module cache stay owned by you.
 GO_IMAGE ?= golang:1.25-alpine
@@ -16,7 +19,7 @@ GO_RUN = timeout 600 docker run --rm --network host --user "$$(id -u):$$(id -g)"
 	  -e HOME=/src/.gocache -e GOMODCACHE=/src/.gocache/mod -e GOCACHE=/src/.gocache/build \
 	  -v "$$PWD":/src -w /src $(GO_IMAGE)
 
-.PHONY: help test vet build up down restart logs ps deps fmt hash-password gen-secret verify-phase1 parse scan calendar
+.PHONY: help test vet build up down restart logs ps deps fmt hash-password gen-secret verify-phase1 parse scan calendar notify morning-brief
 
 help:
 	@echo "make test           run go test ./... in golang:1.25-alpine"
@@ -32,6 +35,9 @@ help:
 	@echo "make parse          parse stored Compass pages into SQLite (Phase 3)"
 	@echo "make scan           fetch + parse one or both children (Phase 4; SCAN_CHILD=Harry|Finn|all)"
 	@echo "make calendar       push important events to the HA calendar (Phase 6; CALENDAR_ARGS=...)"
+	@echo "make notify         build and send the morning briefs via Apprise (Phase 7; NOTIFY_ARGS=...)"
+	@echo "make preview        print the briefs without sending (Phase 7)"
+	@echo "make morning-brief  scan both children, then send the briefs (the n8n job)"
 	@echo "make verify-phase1  prove /health, the login and the Caddy route"
 
 test:
@@ -83,6 +89,18 @@ scan:
 calendar:
 	IMAGE=$(IMAGE) scripts/calendar-push.sh $(if $(CALENDAR_ARGS),$(CALENDAR_ARGS),status)
 
+# Phase 7: send the morning briefs through Apprise (FR-9, FR-14).
+notify:
+	IMAGE=$(IMAGE) scripts/morning-brief.sh --no-scan $(NOTIFY_ARGS)
+
+# Phase 7: print the briefs and send nothing.
+preview:
+	IMAGE=$(IMAGE) scripts/morning-brief.sh --no-scan --dry-run
+
+# Phase 7: the job the 6:00am n8n schedule calls — scan, then send.
+morning-brief:
+	IMAGE=$(IMAGE) scripts/morning-brief.sh
+
 # Phase 1 definition of done: /health 200, login page + session login, and the
 # Caddy route on .35.
 verify-phase1: