Phase 7: daily summary and read-only Hub API (AUD-73)

- internal/hub: project side of the frozen ask-contract. GET /capabilities,
  read-only POST /ask answerer (no LLM, <3s), and the outbound POST /notify
  client.
- internal/apprise: daily-summary delivery through the house Apprise API.
- internal/summary: deterministic plain-text daily summary builder.
- internal/store: CountByCategory, MessagesByCategory, and summary CRUD.
- internal/server: /capabilities and /ask (bearer-token protected), plus the
  Reports screen (/reports, build, send, delete).
- main.go: -summary, -summary-send, and -notify CLI entry points for n8n.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

cmd/email-agent/main.go

@@ -13,12 +13,15 @@ import (
 	"syscall"
 	"time"
 
+	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/apprise"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/classify"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/config"
+	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/hub"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/mailfetch"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/mailops"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/server"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/store"
+	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/summary"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/version"
 )
 
@@ -31,6 +34,9 @@ func main() {
 		classifyAll = flag.Bool("classify-all", false, "re-classify every stored message with JEV and exit")
 		checkSMTP   = flag.Bool("check-smtp", false, "verify the Gmail SMTP connection (IPv4 + STARTTLS + login) and exit; sends no mail")
 		checkThread = flag.Int64("check-thread", 0, "verify that a stored message's Gmail thread has a sent reply (read-only), then exit")
+		summary     = flag.Bool("summary", false, "build today's inbox summary, store it, and print it; sends nothing")
+		summarySend = flag.Bool("summary-send", false, "build today's inbox summary and deliver it by email via Apprise")
+		notify      = flag.Bool("notify", false, "send one test notification to the Hub (POST /notify) and exit")
 	)
 	flag.Parse()
 
@@ -89,6 +95,22 @@ func main() {
 		return
 	}
 
+	if *summary || *summarySend {
+		if err := runSummary(cfg, logger, *summarySend); err != nil {
+			fmt.Fprintf(os.Stderr, "summary failed: %v\n", err)
+			os.Exit(1)
+		}
+		return
+	}
+
+	if *notify {
+		if err := runNotify(cfg, logger); err != nil {
+			fmt.Fprintf(os.Stderr, "notify failed: %v\n", err)
+			os.Exit(1)
+		}
+		return
+	}
+
 	if err := run(cfg, logger); err != nil {
 		logger.Error("fatal", "error", err)
 		os.Exit(1)
@@ -235,6 +257,66 @@ func runCheckThread(cfg *config.Config, logger *slog.Logger, messageID int64) er
 	return nil
 }
 
+// runSummary builds today's inbox summary (FR-10). With send=false it stores and
+// prints the summary and sends nothing; with send=true it also delivers it by
+// email through Apprise. The n8n schedule runs the send form once a day.
+func runSummary(cfg *config.Config, logger *slog.Logger, send bool) error {
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	st, err := store.Open(ctx, cfg.DBPath)
+	if err != nil {
+		return fmt.Errorf("open store: %w", err)
+	}
+	defer func() { _ = st.Close() }()
+
+	data, err := summary.New(st).Build(ctx)
+	if err != nil {
+		return fmt.Errorf("build summary: %w", err)
+	}
+	id, err := st.SaveSummary(ctx, data.Date, data.Text(), "")
+	if err != nil {
+		return err
+	}
+	fmt.Print(data.Text())
+
+	if !send {
+		fmt.Printf("\nsummary stored id=%d (not sent)\n", id)
+		return nil
+	}
+	if !cfg.AppriseConfigured() {
+		return fmt.Errorf("apprise is not configured: set APPRISE_URL and APPRISE_KEY (or APPRISE_URLS)")
+	}
+	if err := apprise.New(cfg.AppriseURL, cfg.AppriseKey, cfg.AppriseURLs, cfg.AppriseToken, 0).
+		Send(ctx, data.Subject(), data.Text()); err != nil {
+		return fmt.Errorf("deliver summary: %w", err)
+	}
+	if err := st.MarkSummaryDelivered(ctx, id, cfg.SummaryTo); err != nil {
+		logger.Error("mark summary delivered", "error", err)
+	}
+	fmt.Printf("\nsummary delivered id=%d to=%s\n", id, cfg.SummaryTo)
+	return nil
+}
+
+// runNotify sends one test notification to the Hub's POST /notify. It exists so
+// the outbound notify path (ask-contract.md) can be exercised without the UI.
+func runNotify(cfg *config.Config, logger *slog.Logger) error {
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	n := hub.NewNotifier(cfg.HubBaseURL, cfg.HubToken, cfg.HubNotifyTimeout, nil)
+	if err := n.Notify(ctx, hub.NotifyRequest{
+		From:    hub.ProjectName,
+		Level:   "info",
+		Message: "Email Agent notify path check.",
+		Person:  "sam",
+	}); err != nil {
+		return err
+	}
+	fmt.Printf("notify ok: %s/notify\n", cfg.HubBaseURL)
+	return nil
+}
+
 // probeHealth requests the local health endpoint. It exists so the container
 // healthcheck does not need an external HTTP client in the image.
 func probeHealth(port int) error {