Adds the morning recap operators asked for: one e-mail summarising the last 24
hours — incident count by severity and type, top attacker IPs, which sites and
subdomains were targeted (uses the new evidence host), how many IPs the Decision
Engine blocked, and agent online status. Complements the real-time per-incident
alerts.

Config (env):
  SECSCAN_DIGEST_ENABLED=true
  SECSCAN_DIGEST_AT=07:00
  SECSCAN_DIGEST_RECIPIENTS=csirt@ponorogo.go.id,kominfo@ponorogo.go.id
  SECSCAN_DIGEST_SEND_WHEN_EMPTY=true

Recipients fall back to the alerting 'critical' audience when unset, so the
report always reaches someone. Scheduled via $schedule->call() per the package
convention. Requires nawasara/notification (added to composer).