Scheduled reports and the weekly digest

An administrator picks sections, a schedule (daily, weekly or monthly,
at a time in a time zone) and recipients, who must be accounts on this
server. Every node looks for due reports once a minute; a run is claimed
with the task lock, keyed by report and due time, and recorded on the
report, so it goes once. The report is built from what the server
already keeps: mail flow, the queue, spoofing from received DMARC
reports, TLS failures, deliverability findings and what changed since
the last run, security counters, people near their quota, and expiring
certificates. It is mailed as text and HTML with optional CSV
attachments, DKIM-signed; a sender domain without a key fails the run
with that reason instead of sending unsigned.

The weekly digest is a built-in report on every server, on by default:
every section, Mondays 07:00 UTC, to the system administrators. It can
be changed or turned off, not deleted. A tenant administrator makes and
sees only their own tenant's reports, which leave out server-wide
sections.

New: inbuxa:ScheduledReport and inbuxa:ScheduledReportSettings, the
sysScheduledReportGet and sysScheduledReportUpdate permissions (granted
once to existing administrator roles), privacy catalog entries, and a
system test. Spec: inbuxa-drafts specs/scheduled-reports.md.

crates/services/src/lib.rs

@@ -27,6 +27,7 @@ pub mod broadcast;
 pub mod inbuxa_lock_expiry;
 pub mod inbuxa_log_retention; // inbuxa: personal-data catalog, D1
 pub mod inbuxa_deliverability; // inbuxa: the deliverability check
+pub mod inbuxa_scheduled_reports; // inbuxa: scheduled reports and the weekly digest
 pub mod state_manager;
 pub mod task_manager;
 
@@ -78,6 +79,9 @@ impl SpawnServices for IpcReceivers {
             // inbuxa: deliverability spec, DL-14: each node checks itself daily
             inbuxa_deliverability::spawn_deliverability(inner.clone());
 
+            // inbuxa: scheduled-reports spec, RP-16: every node looks for due reports
+            inbuxa_scheduled_reports::spawn_scheduled_reports(inner.clone());
+
             // Spawn task scheduler
             spawn_task_scheduler(inner);
         }