fix: normalize daily report layout for Telegram and UI

Ensure server line, compact spacing, and one user per row when ingesting
agent reports or sending SAC-generated daily reports.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/services/ingest.py

@@ -5,6 +5,9 @@ from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
 
 from app.models import Event, Host
+from app.services.daily_report_format import normalize_daily_report_details
+
+DAILY_REPORT_TYPES = frozenset({"report.daily.ssh", "report.daily.rdp"})
 
 
 def _parse_dt(value: str) -> datetime:
@@ -72,6 +75,9 @@ def ingest_event(db: Session, payload: dict) -> tuple[Event, bool]:
         return existing, False
 
     host = upsert_host(db, payload)
+    details = payload.get("details")
+    if payload.get("type") in DAILY_REPORT_TYPES:
+        details = normalize_daily_report_details(details, host, payload["type"])
     event = Event(
         event_id=event_id,
         host_id=host.id,
@@ -81,7 +87,7 @@ def ingest_event(db: Session, payload: dict) -> tuple[Event, bool]:
         severity=payload["severity"],
         title=payload["title"],
         summary=payload["summary"],
-        details=payload.get("details"),
+        details=details,
         raw=payload.get("raw"),
         dedup_key=payload.get("dedup_key"),
         correlation_id=payload.get("correlation_id"),