feat(notifications): add scheduled email reports

[retkatmun]

Closes #1758

Summary

Merchants can now schedule recurring analytics summary emails (daily, weekly, or monthly) delivered via the existing EmailProvider (SendGrid or SES). Previously reports had to be pulled manually.

Changes

New files:

File	Purpose
backend/services/notification/scheduledReportService.ts	Core service: schedule CRUD, recipient management, email rendering, sending, and runDue() batch processing. Includes InMemoryReportStore with an injectable ReportStore interface for swap-in persistence.
backend/services/notification/scheduledReportRouter.ts	Plain Node.js HTTP router mounted at /scheduled-reports. Routes: POST (create), GET (list), GET/:id, PATCH/:id, DELETE/:id, POST/:id/recipients, DELETE/:id/recipients, POST/:id/send-now.
backend/services/notification/jobs/scheduledReportJob.ts	createScheduledReportPoller() (15-min setInterval loop), registerScheduledReportJob() (WeightedFairQueue), createScheduledReportHandler() (queue handler factory).
backend/services/notification/__tests__/scheduledReportService.test.ts	49 unit tests covering all public API paths.

Modified:

• backend/server.ts — wires the service, router, and poller into the server lifecycle; poller is stopped cleanly on shutdown.

Design decisions

• Decoupled from analytics. runDue() accepts a snapshotFor() callback so the service has no hard dependency on SubscriptionAnalyticsService — easy to test and swap.
• Partial failure tolerance. sendReport() iterates recipients individually; one bad address doesn't block the rest; errors are collected in the result.
• Clock-drift safety. nextSendAt() normalises to the start of the hour so minor drift doesn't cause a full-period skip.
• Pluggable persistence. InMemoryReportStore is the default; a real DB store can be injected via the ReportStore interface without touching the service.
• XSS hardening. escapeHtml() applied to all user-controlled strings in HTML output; subject is escaped once, not double-escaped.

Acceptance criteria (from issue)

• Schedule configurable — frequency (daily/weekly/monthly), report type, start time, enable/disable
• Recipients managed — add/remove via API, deduplicated, normalised to lowercase
• Tested — 49 unit tests, all passing

Testing

npx jest --config jest.backend.config.js \
  --testMatch '**/backend/services/notification/__tests__/scheduledReportService.test.ts'

Test Suites: 1 passed
Tests:       49 passed, 0 failed

Covers: nextSendAt() for all frequencies, schedule CRUD validation, recipient management, email rendering for all 4 report types, HTML escaping, partial send failures, post-send timestamp advance, runDue() skipping disabled/empty schedules, and snapshot error isolation.