Phase 7: notify and send via Apprise (Email + WhatsApp)

The morning briefs go out through the house Apprise API on `.35:8210`: one
brief per boy and one combined brief to Jo and Sam (FR-9, FR-14). The service
names an Apprise tag (`harry_email`, `joanna_whatsapp`, ...) and never holds an
address, a phone number or an SMTP password (AGENTS.md §10 rule 3).

- internal/apprise: keyed and stateless client, tag filtering, and error
  redaction so nothing sensitive reaches a log, a row or a screen.
- internal/brief: builds the per-boy and the combined brief, delivers on email
  and WhatsApp, records every attempt in `notifications` (migration 004 adds
  scope, channel, tag, ok and error) and fails loudly.
- Send panel (§5 screen 4): recipients, channels, an exact preview, Send now,
  plus the Send action on a stored draft (FR-10). The dashboard shows a
  Morning briefs banner and the Sends list.
- POST /notify/morning: the bearer-token endpoint the 6:00am n8n schedule
  calls. 207 when a channel or a scan failed; `dry_run=1` checks the wiring
  without messaging the family.
- scripts/morning-brief.sh: scan both children, then send. It is the n8n job;
  deploy/n8n-morning-brief.json is the ready-to-import workflow (06:00 daily).
- FR-12: a failed scan is never "nothing due" -- the brief says so, and the run
  exits non-zero. A failed delivery is recorded with no sent_at.
- The long no-due-date tail is capped in the sent brief so it stays brief
  (§10 rule 6); overdue work is never capped.

Verified live: 8 deliveries recorded (4 email, 4 WhatsApp) with HTTP 200 and
sent_at, and the endpoint answers 401/200/207 as documented. Evidence in
docs/phase-7-notify-notes.md.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

deploy/DEPLOYMENT.md

@@ -56,3 +56,56 @@ on `.35` (sam-ubuntu1) terminates TLS and proxies to `192.168.20.13:8792`.
   create a project network.
 - The env file is gitignored. School credentials and harness session state are
   secrets (AGENTS.md §10 rule 3); they never enter git.
+
+## Phase 7 — notifications (Apprise)
+
+The morning briefs are delivered through the house **Apprise** API on `.35:8210`
+(container `apprise`, host port 8210 → container 8000). Caddy exposes it at
+`https://apprise.lab.audasmedia.com.au` behind basic auth; the service talks to
+the API directly on the internal address.
+
+1. Create (or reuse) the Apprise **stored configuration** that holds every
+   destination, using these tags:
+
+   | Tag | Destination |
+   |---|---|
+   | `harry_email`, `finn_email`, `joanna_email`, `sam_email` | email |
+   | `harry_whatsapp`, `finn_whatsapp`, `joanna_whatsapp`, `sam_whatsapp` | WhatsApp (CallMeBot) |
+
+2. Copy its **key** into `environment.d/school-service.env` as
+   `SCHOOL_APPRISE_KEY`, and generate the n8n token:
+
+   ```bash
+   docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.5.0-phase7 gen-secret
+   # -> SCHOOL_NOTIFY_TOKEN=<the value>
+   ```
+
+3. Restart the service, then prove the whole path without messaging anyone:
+
+   ```bash
+   make preview                      # prints both boys + the combined brief
+   curl -s -X POST -H "Authorization: Bearer $SCHOOL_NOTIFY_TOKEN" \
+        'http://127.0.0.1:8792/notify/morning?dry_run=1' | jq .
+   ```
+
+4. Send for real (this messages the family):
+
+   ```bash
+   make notify                       # from the latest scan
+   make morning-brief                # scan both children, then send
+   docker exec compass-teams-nhs /app/school notify status
+   ```
+
+5. Import `deploy/n8n-morning-brief.json` in n8n, set `SCHOOL_NOTIFY_TOKEN` in
+   the n8n environment, and activate the workflow (06:00 daily, Australia/Melbourne).
+
+Notes:
+
+- The destination URLs (addresses, phone numbers, SMTP passwords) live only in
+  the Apprise configuration. `GET /json/urls/{key}` prints `callmebot://` for a
+  WhatsApp entry because Apprise masks credentials in privacy mode; the entry is
+  real, and the container log shows `CallMeBot SUCCESS`.
+- The scan stays a host step: patchright and its browser are on `.13`, not in the
+  service image. `scripts/morning-brief.sh` runs the scan and the send in order.
+- A run that cannot deliver exits non-zero, and the endpoint answers `207`, so a
+  broken morning is visible in n8n instead of silent (FR-12).