feat: SAC daily reports from DB aggregation (notif-32)

- Aggregate report.daily.ssh/rdp from 24h ingest; job and systemd timer

- notify_daily_report bypasses NOTIFY_MIN_SEVERITY; ingest routes agent reports

- HTML templates, env SAC_DAILY_REPORT_*, docs and tests (56 cases)

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/env.native.example

@@ -53,6 +53,13 @@ SAC_NOTIFY_COOLDOWN_ENABLED=true
 SAC_NOTIFY_EVENT_COOLDOWN_SEC=90
 SAC_NOTIFY_PROBLEM_COOLDOWN_SEC=300
 
+# Суточные отчёты из SAC (F-NOT-05; systemd sac-daily-report.timer)
+SAC_DAILY_REPORT_ENABLED=true
+SAC_DAILY_REPORT_HOUR=9
+SAC_DAILY_REPORT_TIMEZONE=Europe/Moscow
+SAC_DAILY_REPORT_SKIP_IF_AGENT_SENT=true
+SAC_DAILY_REPORT_REQUIRE_ACTIVITY=true
+
 # Статус хоста по agent.heartbeat
 SAC_HEARTBEAT_STALE_MINUTES=780
 

deploy/systemd/sac-daily-report.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Security Alert Center daily report generation (F-NOT-05)
+After=network-online.target postgresql.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=sac
+Group=sac
+WorkingDirectory=/opt/security-alert-center/backend
+EnvironmentFile=/opt/security-alert-center/config/sac-api.env
+ExecStart=/opt/security-alert-center/backend/.venv/bin/python -m app.jobs.daily_report
+Nice=10
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/sac-daily-report.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Daily SAC report aggregation and notify
+
+[Timer]
+OnCalendar=*-*-* 09:15:00
+RandomizedDelaySec=300
+Persistent=true
+
+[Install]
+WantedBy=timers.target