feat: SAC daily reports from DB aggregation (notif-32)

- Aggregate report.daily.ssh/rdp from 24h ingest; job and systemd timer

- notify_daily_report bypasses NOTIFY_MIN_SEVERITY; ingest routes agent reports

- HTML templates, env SAC_DAILY_REPORT_*, docs and tests (56 cases)

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/jobs/daily_report.py

@@ -0,0 +1,45 @@
+"""CLI: python -m app.jobs.daily_report [--force]"""
+
+from __future__ import annotations
+
+import argparse
+import logging
+import sys
+
+from app.database import SessionLocal
+from app.services.daily_report import run_daily_reports
+
+logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
+logger = logging.getLogger("sac.daily_report")
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Generate SAC daily reports from DB events")
+    parser.add_argument(
+        "--force",
+        action="store_true",
+        help="Ignore SAC_DAILY_REPORT_HOUR (for manual run / tests)",
+    )
+    args = parser.parse_args(argv)
+
+    db = SessionLocal()
+    try:
+        results = run_daily_reports(db, force=args.force)
+        created = [r for r in results if r.created]
+        logger.info("created %s reports", len(created))
+        for r in created:
+            logger.info("  %s %s event_id=%s", r.hostname, r.report_type, r.event_id)
+        skipped = [r for r in results if not r.created and r.skipped_reason]
+        for r in skipped:
+            logger.info("  skip %s: %s", r.hostname, r.skipped_reason)
+        return 0
+    except Exception:
+        db.rollback()
+        logger.exception("daily report job failed")
+        return 1
+    finally:
+        db.close()
+
+
+if __name__ == "__main__":
+    sys.exit(main())