Phase 7: notify and send via Apprise (Email + WhatsApp)

The morning briefs go out through the house Apprise API on `.35:8210`: one
brief per boy and one combined brief to Jo and Sam (FR-9, FR-14). The service
names an Apprise tag (`harry_email`, `joanna_whatsapp`, ...) and never holds an
address, a phone number or an SMTP password (AGENTS.md §10 rule 3).

- internal/apprise: keyed and stateless client, tag filtering, and error
  redaction so nothing sensitive reaches a log, a row or a screen.
- internal/brief: builds the per-boy and the combined brief, delivers on email
  and WhatsApp, records every attempt in `notifications` (migration 004 adds
  scope, channel, tag, ok and error) and fails loudly.
- Send panel (§5 screen 4): recipients, channels, an exact preview, Send now,
  plus the Send action on a stored draft (FR-10). The dashboard shows a
  Morning briefs banner and the Sends list.
- POST /notify/morning: the bearer-token endpoint the 6:00am n8n schedule
  calls. 207 when a channel or a scan failed; `dry_run=1` checks the wiring
  without messaging the family.
- scripts/morning-brief.sh: scan both children, then send. It is the n8n job;
  deploy/n8n-morning-brief.json is the ready-to-import workflow (06:00 daily).
- FR-12: a failed scan is never "nothing due" -- the brief says so, and the run
  exits non-zero. A failed delivery is recorded with no sent_at.
- The long no-due-date tail is capped in the sent brief so it stays brief
  (§10 rule 6); overdue work is never capped.

Verified live: 8 deliveries recorded (4 email, 4 WhatsApp) with HTTP 200 and
sent_at, and the endpoint answers 401/200/207 as documented. Evidence in
docs/phase-7-notify-notes.md.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/web/static/app.css

@@ -423,7 +423,8 @@ a:hover { text-decoration: underline; }
 }
 .item__subject { color: var(--ink-secondary); }
 .item__due { color: var(--ink-secondary); }
-.item__actions { margin: 0; flex: 0 0 auto; }
+.item__actions { display: flex; flex-wrap: wrap; gap: var(--space-xs); margin: 0; flex: 0 0 auto; justify-content: flex-end; }
+.item__actions form { margin: 0; }
 
 .tag {
   display: inline-flex;
@@ -507,3 +508,29 @@ a:hover { text-decoration: underline; }
   .item__actions .button-utility { width: 100%; }
   .child__head { flex-direction: column; }
 }
+
+/* ---------- Send panel (Phase 7: recipients, preview, send) ---------- */
+
+.send-card {
+  display: grid;
+  gap: var(--space-sm);
+  padding: var(--space-md) var(--space-lg);
+  background: var(--surface);
+  border: 1px solid var(--hairline);
+  border-radius: var(--rounded-lg);
+  box-shadow: var(--shadow-level-1);
+}
+.send-card__summary {
+  cursor: pointer;
+  font: var(--type-body-md);
+  font-weight: 600;
+  color: var(--ink);
+}
+.send-card__form { display: grid; gap: var(--space-md); margin-top: var(--space-sm); }
+.send-card__actions { display: flex; flex-wrap: wrap; gap: var(--space-sm); align-items: center; }
+.send-card__hint { font: var(--type-caption); color: var(--ink-muted); }
+.check-row { display: flex; flex-wrap: wrap; gap: var(--space-sm) var(--space-lg); }
+.check { display: inline-flex; align-items: center; gap: var(--space-xxs); font: var(--type-body-sm); }
+
+.brief-wrap { display: grid; gap: var(--space-xxs); }
+.brief-wrap > summary { cursor: pointer; }