feat: QuickBooks Online integration

- Add QBO OAuth2 client with token refresh (lib/services/qbo-client.ts)
- Add QBO sync service for invoices, payments, deposits, purchases, journal entries, reports (lib/services/qbo-sync-service.ts)
- Add QBO types (lib/types/qbo.ts)
- Add API routes: /api/qbo/auth, /api/qbo/sync, /api/qbo/disconnect
- Add /admin/qbo status and sync management page
- Add legal pages: /legal/eula, /legal/privacy (Intuit app assessment)
- Add QBO nav link under Admin
- Fix reports: remove invalid summarize_column_by, add accounting_method from Preferences API, add showrows=all&showcols=all
- Add CashFlow report type alongside P&L and BalanceSheet
- Add NoReportData check to skip empty report months
- Add intuit_tid capture in error messages
- Add redirect: follow for cluster routing
- Migration 051: qbo_tokens, qbo_invoices, qbo_payments, qbo_deposits, qbo_transactions, qbo_reports tables

Also includes earlier work:
- Ping flap suppression pipeline step
- Ticket digest reports with LLM analysis
- Zabbix WAN monitor and gap analysis
- Kiosk is_deleted filter fixes
- Datto RMM ping target enrichment
- Entity sync soft-delete detection

migrations/049_create_ticket_digest_tables.sql

@@ -0,0 +1,53 @@
+-- Ticket Digest Report tables
+-- Stores config, delivery webhooks, and report history for LLM-analyzed ticket digest reports
+
+CREATE TABLE IF NOT EXISTS ticket_digest_config (
+  id INTEGER PRIMARY KEY DEFAULT 1,
+  daily_enabled BOOLEAN NOT NULL DEFAULT false,
+  weekly_enabled BOOLEAN NOT NULL DEFAULT false,
+  monthly_enabled BOOLEAN NOT NULL DEFAULT false,
+  daily_cron VARCHAR(50) NOT NULL DEFAULT '0 7 * * 1-5',
+  weekly_cron VARCHAR(50) NOT NULL DEFAULT '0 7 * * 1',
+  monthly_cron VARCHAR(50) NOT NULL DEFAULT '0 7 1 * *',
+  llm_provider VARCHAR(20) NOT NULL DEFAULT 'anthropic',
+  llm_model VARCHAR(100) NOT NULL DEFAULT 'claude-sonnet-4-20250514',
+  include_noise_analysis BOOLEAN NOT NULL DEFAULT true,
+  include_sla_analysis BOOLEAN NOT NULL DEFAULT true,
+  include_resource_analysis BOOLEAN NOT NULL DEFAULT true,
+  include_client_analysis BOOLEAN NOT NULL DEFAULT true,
+  include_recommendations BOOLEAN NOT NULL DEFAULT true,
+  created_at TIMESTAMP NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMP NOT NULL DEFAULT NOW(),
+  CONSTRAINT single_config CHECK (id = 1)
+);
+
+CREATE TABLE IF NOT EXISTS ticket_digest_webhooks (
+  id SERIAL PRIMARY KEY,
+  label VARCHAR(200) NOT NULL,
+  webhook_url TEXT NOT NULL,
+  digest_types TEXT[] NOT NULL DEFAULT '{daily,weekly,monthly}',
+  enabled BOOLEAN NOT NULL DEFAULT true,
+  last_delivered_at TIMESTAMP,
+  last_status VARCHAR(20),
+  created_at TIMESTAMP NOT NULL DEFAULT NOW()
+);
+
+CREATE TABLE IF NOT EXISTS ticket_digest_reports (
+  id SERIAL PRIMARY KEY,
+  period_type VARCHAR(10) NOT NULL, -- 'daily', 'weekly', 'monthly'
+  period_start TIMESTAMP NOT NULL,
+  period_end TIMESTAMP NOT NULL,
+  generated_at TIMESTAMP NOT NULL DEFAULT NOW(),
+  stats JSONB NOT NULL DEFAULT '{}',
+  llm_analysis TEXT,
+  card_payload JSONB,
+  delivery_status JSONB DEFAULT '{}',
+  tokens_used INTEGER,
+  processing_time_ms INTEGER,
+  created_at TIMESTAMP NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_ticket_digest_reports_period ON ticket_digest_reports(period_type, period_start DESC);
+
+-- Insert default config
+INSERT INTO ticket_digest_config (id) VALUES (1) ON CONFLICT (id) DO NOTHING;