Phase 7a: real 6:00am n8n schedule for the school brief (AUD-115)

The 06:00 workflow is now one schedule-trigger -> Execute Command pair that
runs scripts/morning-brief.sh on the host over a restricted SSH key. The
earlier scan -> HTTP shape could not work: the n8n container cannot resolve
the `remote` ssh alias (its ~/.ssh/config is a dangling nix symlink) and a
split scan node hides scan failures before the notify node runs.

- deploy/n8n-morning-brief.json: two-node workflow, scheduleTrigger v1.3
- deploy/setup-n8n-scan-key.sh: restricted (restrict,command=) trigger key
- deploy/import-n8n-morning-brief.sh: import + publish + restart + verify
- deploy/DEPLOYMENT.md, Makefile: document and expose both scripts (dry run)
- docs/phase-7a-n8n-schedule.md: design, verification, failure drill

Import into the shared n8n service still needs Sam's approval.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

deploy/n8n-morning-brief.json

@@ -15,53 +15,20 @@
       "id": "c1a0a0a0-0000-4000-8000-000000000001",
       "name": "6:00am every day",
       "type": "n8n-nodes-base.scheduleTrigger",
-      "typeVersion": 1.2,
+      "typeVersion": 1.3,
       "position": [200, 300]
     },
     {
       "parameters": {
-        "command": "ssh remote 'cd /home/sam/paseo/projects/compass_teams_nhs && scripts/scan-compass.sh'"
+        "executeOnce": true,
+        "command": "ssh -i /home/node/.ssh/id_ed25519_school_scan -o IdentitiesOnly=yes -o BatchMode=yes -o UserKnownHostsFile=/home/node/.ssh/known_hosts -o StrictHostKeyChecking=yes sam@192.168.20.13 'cd /home/sam/paseo/projects/compass_teams_nhs && ./scripts/morning-brief.sh'"
       },
       "id": "c1a0a0a0-0000-4000-8000-000000000002",
-      "name": "Scan Compass (both children, read-only)",
+      "name": "Scan both children and send the briefs",
       "type": "n8n-nodes-base.executeCommand",
       "typeVersion": 1,
       "position": [480, 300],
-      "notes": "The scan needs node + patchright on the host, so it runs outside the service container. A failed scan still lets the briefs go out: the brief carries the failure notice (FR-12)."
-    },
-    {
-      "parameters": {
-        "method": "POST",
-        "url": "http://192.168.20.13:8792/notify/morning",
-        "sendHeaders": true,
-        "headerParameters": {
-          "parameters": [
-            {
-              "name": "Authorization",
-              "value": "=Bearer {{$env.SCHOOL_NOTIFY_TOKEN}}"
-            },
-            {
-              "name": "Content-Type",
-              "value": "application/json"
-            }
-          ]
-        },
-        "sendBody": false,
-        "options": {
-          "timeout": 240000,
-          "response": {
-            "response": {
-              "neverError": true
-            }
-          }
-        }
-      },
-      "id": "c1a0a0a0-0000-4000-8000-000000000003",
-      "name": "Send the morning briefs",
-      "type": "n8n-nodes-base.httpRequest",
-      "typeVersion": 4.2,
-      "position": [760, 300],
-      "notes": "POST /notify/morning builds one brief per boy plus the combined brief to Jo and Sam and delivers them through Apprise. 200 = every channel delivered; 207 = a channel failed or a scan failed; 503 = SCHOOL_NOTIFY_TOKEN is not set on the service."
+      "notes": "One bounded host command. The scan needs node + patchright on .13, so it runs outside this container. scripts/morning-brief.sh scans both children, builds the per-boy and combined briefs and sends them through Apprise, then exits non-zero if the scan or a send fails, so this execution goes red (FR-12). The key is restricted in authorized_keys to exactly this command."
     }
   ],
   "connections": {
@@ -69,18 +36,7 @@
       "main": [
         [
           {
-            "node": "Scan Compass (both children, read-only)",
-            "type": "main",
-            "index": 0
-          }
-        ]
-      ]
-    },
-    "Scan Compass (both children, read-only)": {
-      "main": [
-        [
-          {
-            "node": "Send the morning briefs",
+            "node": "Scan both children and send the briefs",
             "type": "main",
             "index": 0
           }