feat: scheduled KPI reports

[2ndtlmining]

A weekly report that arrives every Monday is worth considerably more than one somebody remembers to click. The KPI feature is currently on-demand only.

Proposed

Use the existing node-cron dependency to send configured reports automatically:

• A stored list of destinations: timeframe, medium, target, enabled.
• Weekly reports fire on Monday (once the previous week is complete), monthly on the 1st, quarterly on the 1st of the quarter, yearly on Jan 1 — always after the period being reported has closed.
• Skip and log rather than sending an incomplete report if the data-coverage check fails, so a scheduled send can't quietly deliver a half-empty report.

Open questions

• Where destinations are stored — a new table, or config? A table allows managing them from the UI; config is simpler and keeps webhook URLs out of the database.
• Whether scheduled sends bypass the rate limiter (they should be exempt from the per-client limit, but the per-destination limit still guards against duplicate sends).
• Whether a failed scheduled send retries, and how failures surface — probably via /api/health.

Notes

Webhook URLs are bearer credentials. If they go in the database, they should not appear in any API response that isn't authenticated, and logs must keep masking them.