Phase 7: notify and send via Apprise (Email + WhatsApp)

The morning briefs go out through the house Apprise API on `.35:8210`: one
brief per boy and one combined brief to Jo and Sam (FR-9, FR-14). The service
names an Apprise tag (`harry_email`, `joanna_whatsapp`, ...) and never holds an
address, a phone number or an SMTP password (AGENTS.md §10 rule 3).

- internal/apprise: keyed and stateless client, tag filtering, and error
  redaction so nothing sensitive reaches a log, a row or a screen.
- internal/brief: builds the per-boy and the combined brief, delivers on email
  and WhatsApp, records every attempt in `notifications` (migration 004 adds
  scope, channel, tag, ok and error) and fails loudly.
- Send panel (§5 screen 4): recipients, channels, an exact preview, Send now,
  plus the Send action on a stored draft (FR-10). The dashboard shows a
  Morning briefs banner and the Sends list.
- POST /notify/morning: the bearer-token endpoint the 6:00am n8n schedule
  calls. 207 when a channel or a scan failed; `dry_run=1` checks the wiring
  without messaging the family.
- scripts/morning-brief.sh: scan both children, then send. It is the n8n job;
  deploy/n8n-morning-brief.json is the ready-to-import workflow (06:00 daily).
- FR-12: a failed scan is never "nothing due" -- the brief says so, and the run
  exits non-zero. A failed delivery is recorded with no sent_at.
- The long no-due-date tail is capped in the sent brief so it stays brief
  (§10 rule 6); overdue work is never capped.

Verified live: 8 deliveries recorded (4 email, 4 WhatsApp) with HTTP 200 and
sent_at, and the endpoint answers 401/200/207 as documented. Evidence in
docs/phase-7-notify-notes.md.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/dashboard/dashboard.go

@@ -178,29 +178,50 @@ func startOfDay(t time.Time, loc *time.Location) time.Time {
 	return time.Date(t.Year(), t.Month(), t.Day(), 0, 0, 0, 0, loc)
 }
 
+// Limits caps a section so a brief stays brief (AGENTS.md §10 rule 6). Overdue
+// work is never capped; pending work without a due date is the long tail, so it
+// is the one that is summarised.
+type Limits struct {
+	// NoDue is the most no-due-date items a brief lists (0 means no cap).
+	NoDue int
+}
+
+// MorningLimits is the cap the per-boy and combined morning briefs use. The
+// dashboard and the preview always show the full lists.
+var MorningLimits = Limits{NoDue: 5}
+
 // Render writes one child's brief as plain text: overdue first, then due today,
 // due this week, no due date and messages (FR-9, FR-14, AGENTS.md §4 rule 6).
 func Render(child string, b Buckets, loc *time.Location) string {
+	return RenderWithLimits(child, b, loc, Limits{})
+}
+
+// RenderWithLimits is Render with a cap on the long-tail sections.
+func RenderWithLimits(child string, b Buckets, loc *time.Location, lim Limits) string {
 	if loc == nil {
 		loc = time.UTC
 	}
 	var sb strings.Builder
 	fmt.Fprintf(&sb, "%s — %s.\n", child, b.Headline())
 
-	writeSection(&sb, "OVERDUE", b.Overdue, loc)
-	writeSection(&sb, "DUE TODAY", b.DueToday, loc)
-	writeSection(&sb, "DUE THIS WEEK", b.DueWeek, loc)
-	writeSection(&sb, "NO DUE DATE", b.NoDue, loc)
+	writeSection(&sb, "OVERDUE", b.Overdue, loc, 0)
+	writeSection(&sb, "DUE TODAY", b.DueToday, loc, 0)
+	writeSection(&sb, "DUE THIS WEEK", b.DueWeek, loc, 0)
+	writeSection(&sb, "NO DUE DATE", b.NoDue, loc, lim.NoDue)
 	writeMessages(&sb, b.Messages, loc)
 	return strings.TrimRight(sb.String(), "\n") + "\n"
 }
 
-func writeSection(sb *strings.Builder, title string, items []store.Item, loc *time.Location) {
+func writeSection(sb *strings.Builder, title string, items []store.Item, loc *time.Location, limit int) {
 	if len(items) == 0 {
 		return
 	}
 	fmt.Fprintf(sb, "\n%s\n", title)
-	for _, it := range items {
+	for i, it := range items {
+		if limit > 0 && i >= limit {
+			fmt.Fprintf(sb, "- … and %d more with no due date (see the dashboard)\n", len(items)-limit)
+			break
+		}
 		fmt.Fprintf(sb, "- %s\n", line(it, loc))
 	}
 }
@@ -219,6 +240,110 @@ func writeMessages(sb *strings.Builder, items []store.Item, loc *time.Location)
 	}
 }
 
+// Combined is one child's share of the combined brief.
+type Combined struct {
+	Child   string
+	Buckets Buckets
+}
+
+// RenderCombined writes the single brief for Jo and Sam (FR-14): both boys in
+// one message, overdue first, lists only (AGENTS.md §10 rule 6). Every line is
+// prefixed with the child's name so a parent never has to guess whose work it
+// is. It never claims "nothing due" by itself: the caller adds the scan warning
+// when a scan failed (FR-12).
+func RenderCombined(parts []Combined, loc *time.Location) string {
+	return RenderCombinedWithLimits(parts, loc, Limits{})
+}
+
+// RenderCombinedWithLimits is RenderCombined with a cap on the long tail.
+func RenderCombinedWithLimits(parts []Combined, loc *time.Location, lim Limits) string {
+	if loc == nil {
+		loc = time.UTC
+	}
+	names := make([]string, 0, len(parts))
+	for _, p := range parts {
+		names = append(names, p.Child)
+	}
+
+	var sb strings.Builder
+	fmt.Fprintf(&sb, "%s — %s.\n", joinNames(names), combinedHeadline(parts))
+
+	writeCombined(&sb, "OVERDUE", parts, loc, 0, func(b Buckets) []store.Item { return b.Overdue })
+	writeCombined(&sb, "DUE TODAY", parts, loc, 0, func(b Buckets) []store.Item { return b.DueToday })
+	writeCombined(&sb, "DUE THIS WEEK", parts, loc, 0, func(b Buckets) []store.Item { return b.DueWeek })
+	writeCombined(&sb, "NO DUE DATE", parts, loc, lim.NoDue, func(b Buckets) []store.Item { return b.NoDue })
+	writeCombinedMessages(&sb, parts, loc)
+	return strings.TrimRight(sb.String(), "\n") + "\n"
+}
+
+// joinNames renders "Harry and Finn" for any number of children.
+func joinNames(names []string) string {
+	switch len(names) {
+	case 0:
+		return "School brief"
+	case 1:
+		return names[0]
+	case 2:
+		return names[0] + " and " + names[1]
+	default:
+		return strings.Join(names[:len(names)-1], ", ") + " and " + names[len(names)-1]
+	}
+}
+
+// combinedHeadline counts both boys in one line, so the whole family sees the
+// size of the day before the lists.
+func combinedHeadline(parts []Combined) string {
+	var overdue, today, week, messages int
+	for _, p := range parts {
+		overdue += len(p.Buckets.Overdue)
+		today += len(p.Buckets.DueToday)
+		week += len(p.Buckets.DueWeek)
+		messages += len(p.Buckets.Messages)
+	}
+	return fmt.Sprintf("%d overdue · %d due today · %d this week · %d message(s)",
+		overdue, today, week, messages)
+}
+
+func writeCombined(sb *strings.Builder, title string, parts []Combined, loc *time.Location, limit int, pick func(Buckets) []store.Item) {
+	var lines []string
+	for _, p := range parts {
+		for _, it := range pick(p.Buckets) {
+			lines = append(lines, fmt.Sprintf("- %s: %s\n", p.Child, line(it, loc)))
+		}
+	}
+	if len(lines) == 0 {
+		return
+	}
+	fmt.Fprintf(sb, "\n%s\n", title)
+	for i, l := range lines {
+		if limit > 0 && i >= limit {
+			fmt.Fprintf(sb, "- … and %d more with no due date (see the dashboard)\n", len(lines)-limit)
+			break
+		}
+		sb.WriteString(l)
+	}
+}
+
+func writeCombinedMessages(sb *strings.Builder, parts []Combined, loc *time.Location) {
+	var lines []string
+	for _, p := range parts {
+		for _, it := range p.Buckets.Messages {
+			when := ""
+			if it.DueAt != nil {
+				when = " (" + it.DueAt.In(loc).Format("Mon 02 Jan 15:04") + ")"
+			}
+			lines = append(lines, fmt.Sprintf("- %s: %s%s\n", p.Child, it.Title, when))
+		}
+	}
+	if len(lines) == 0 {
+		return
+	}
+	sb.WriteString("\nMESSAGES\n")
+	for _, l := range lines {
+		sb.WriteString(l)
+	}
+}
+
 // line renders one actionable item for the brief.
 func line(it store.Item, loc *time.Location) string {
 	subject := strings.TrimSpace(it.Subject)