feat: SAC daily reports from DB aggregation (notif-32)

- Aggregate report.daily.ssh/rdp from 24h ingest; job and systemd timer

- notify_daily_report bypasses NOTIFY_MIN_SEVERITY; ingest routes agent reports

- HTML templates, env SAC_DAILY_REPORT_*, docs and tests (56 cases)

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/runbook-ops.md

@@ -61,6 +61,21 @@ sudo systemctl enable --now sac-retention.timer
 systemctl list-timers sac-retention.timer
 ```
 
+## Суточные отчёты (F-NOT-05)
+
+```bash
+sudo cp /opt/security-alert-center/deploy/systemd/sac-daily-report.service /etc/systemd/system/
+sudo cp /opt/security-alert-center/deploy/systemd/sac-daily-report.timer /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now sac-daily-report.timer
+systemctl list-timers sac-daily-report.timer
+
+# Ручной прогон (игнор часа)
+sudo -u sac bash -lc 'cd /opt/security-alert-center/backend && .venv/bin/python -m app.jobs.daily_report --force'
+```
+
+Переменные: `SAC_DAILY_REPORT_*` в `config/sac-api.env` (см. `deploy/env.native.example`).
+
 ## Health и мониторинг
 
 | Endpoint | Назначение |