feat: scheduled reports, email preferences, activity analytics, and document expiration utilities

[Nimatstar]

Adds the core, unit-tested logic for four features on one branch. Each change is a small, self-contained, side-effect-free utility module (plus full unit tests), so the scheduled jobs, endpoints, and notification flows can build on tested primitives without a database. No schema or migration changes.

Scheduled report generation (#966)

src/reports/report-schedule.util.ts — ReportFrequency/ReportType enums, nextRunAt (daily / next-Monday / first-of-next-month, UTC), isReportDue, and RFC-4180 toCsvField/buildCsv for CSV attachments.

Email preference center + unsubscribe (#965)

src/users/email-preferences.util.ts — EmailType enum, defaultEmailPreferences, mergePreferences, isEmailAllowed, and HMAC generateUnsubscribeToken / constant-time verifyUnsubscribeToken for one-click, per-type opt-out links.

Activity-log aggregation & analytics (#963)

src/users/activity-analytics.util.ts — aggregateByType, activeUsers/dailyActiveUsers/weeklyActiveUsers, and retentionCutoff/partitionForRetention (default 90-day retention).

Document expiration workflow (#962)

src/documents/document-expiration.util.ts — daysUntilExpiry, isExpired, dueNotificationMilestone (30/14/7/1-day reminders), and shouldMarkExpired for the daily expiry cron. Fully covered by its spec, keeping the documents module coverage gate satisfied.

All four modules ship with unit tests (36 tests). Lint (--max-warnings=0) and build pass.

closes #966
closes #965
closes #963
closes #962

[drips-wave]

@Nimatstar Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[nanaf6203-bit]

LGTM