Phase 7: notify and send via Apprise (Email + WhatsApp)

The morning briefs go out through the house Apprise API on `.35:8210`: one
brief per boy and one combined brief to Jo and Sam (FR-9, FR-14). The service
names an Apprise tag (`harry_email`, `joanna_whatsapp`, ...) and never holds an
address, a phone number or an SMTP password (AGENTS.md §10 rule 3).

- internal/apprise: keyed and stateless client, tag filtering, and error
  redaction so nothing sensitive reaches a log, a row or a screen.
- internal/brief: builds the per-boy and the combined brief, delivers on email
  and WhatsApp, records every attempt in `notifications` (migration 004 adds
  scope, channel, tag, ok and error) and fails loudly.
- Send panel (§5 screen 4): recipients, channels, an exact preview, Send now,
  plus the Send action on a stored draft (FR-10). The dashboard shows a
  Morning briefs banner and the Sends list.
- POST /notify/morning: the bearer-token endpoint the 6:00am n8n schedule
  calls. 207 when a channel or a scan failed; `dry_run=1` checks the wiring
  without messaging the family.
- scripts/morning-brief.sh: scan both children, then send. It is the n8n job;
  deploy/n8n-morning-brief.json is the ready-to-import workflow (06:00 daily).
- FR-12: a failed scan is never "nothing due" -- the brief says so, and the run
  exits non-zero. A failed delivery is recorded with no sent_at.
- The long no-due-date tail is capped in the sent brief so it stays brief
  (§10 rule 6); overdue work is never capped.

Verified live: 8 deliveries recorded (4 email, 4 WhatsApp) with HTTP 200 and
sent_at, and the endpoint answers 401/200/207 as documented. Evidence in
docs/phase-7-notify-notes.md.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

environment.d/school-service.env.example

@@ -45,3 +45,32 @@ SCHOOL_HA_CALENDAR_ENTITY=calendar.school
 # Set true only when SCHOOL_HA_URL is the https://homeassistant.home.lab URL.
 SCHOOL_HA_INSECURE=false
 SCHOOL_HA_TIMEOUT=20s
+
+# ---- Apprise notifications (AGENTS.md §4 FR-9/FR-14, §11 Phase 7) ----------
+# The morning briefs go out through the house Apprise API on `.35:8210`. The
+# Apprise configuration holds every destination (email address, WhatsApp number,
+# SMTP password); this service only names a tag such as "harry_email", so no
+# address or password is ever stored here or committed (AGENTS.md §10 rule 3).
+#
+# Create the stored configuration once in the Apprise web UI
+# (https://apprise.lab.audasmedia.com.au), then copy its key here. The key acts
+# like a password: keep it in this file only, never in git.
+SCHOOL_APPRISE_URL=http://192.168.20.35:8210
+SCHOOL_APPRISE_KEY=
+# Optional bearer token if the Apprise API is protected. Empty in this lab.
+SCHOOL_APPRISE_TOKEN=
+SCHOOL_APPRISE_TIMEOUT=15s
+
+# Channels the morning brief uses (AGENTS.md §13 decision 8). Each recipient
+# needs a tag per channel: <tag base>_email and <tag base>_whatsapp.
+SCHOOL_APPRISE_CHANNELS=email,whatsapp
+
+# Recipients: Name=tag-base. The boys are children in the database and get their
+# own brief; the rest are parents and get one combined brief (FR-9, FR-14).
+SCHOOL_APPRISE_TAGS=Harry=harry,Finn=finn,Jo=joanna,Sam=sam
+SCHOOL_APPRISE_PARENTS=Jo,Sam
+
+# Bearer token for POST /notify/morning, the endpoint n8n calls at 6:00am.
+# Generate one and keep it here:
+#   docker run --rm --entrypoint /app/school <image> gen-secret
+SCHOOL_NOTIFY_TOKEN=