Add digest as a real outcome: suppressed care nudges get resurfaced, not lost

Vikunja #281. The interruption policy promised four outcomes — deliver_now,
queue, digest, drop — but only three existed: a care candidate the restraint
gate suppressed for quiet hours / away / calendar-busy simply vanished in
loop.Tick's `continue`, with only the trace remembering why.

internal/morning turned out not to be the natural drain: it's a fixed
Item/FactKey checklist engine, not a generic message bundler, so gate-
suppressed nudge text has nowhere to plug into its evidence model. Built a
parallel (but small, reusing the outbox's shape) durable digest instead:

- internal/store: digest_entries table + EnqueueDigestEntry (dedupes by
  rule+body, mirroring the delivery outbox's bodyHash), PendingDigestEntries,
  ExpireStaleDigestEntries, DrainDigestEntries (mark, never delete — an
  audit trail of what she actually said).
- internal/loop: DigestEligible(severity, blockedBy) is the pure boundary —
  only genuine restraint blocks (quiet_hours/calendar_busy/presence) even
  qualify (cooldown/snooze are not "suppression"); within care, Sev2 (break)
  digests, Sev1 (water/meal — stale by the time anyone could resurface them)
  drops. High severity never digests; alarms bypass the gate and deliver
  unchanged, on purpose.
- cmd/mavend/tick.go: each tick scans ExplainTick's trace for eligible
  blocked candidates, enqueues them, sweeps stale entries (24h expiry — the
  care rules are daily-cadence, so anything older is describing a day
  that's over), and drains the bundle only once the suppression reason has
  actually cleared, capped at 3 spoken items plus a trailing count so a
  digest can't turn into the exact nagging it was built to avoid.

Tests: store-level round-trip/restart-survival/dedupe/expiry/drain, loop-
level severity-boundary unit tests, and tick-level integration tests for
the drain-only-when-clear and never-digest-high-severity behavior.

internal/store/migrations.go

@@ -112,6 +112,25 @@ ALTER TABLE reminders ADD COLUMN next_fire_ts INTEGER;`, // #2
 	DROP TABLE delivery_attempts;
 	ALTER TABLE delivery_attempts_v12 RENAME TO delivery_attempts;
 	CREATE INDEX IF NOT EXISTS idx_delivery_attempts_status ON delivery_attempts (status);`,
+
+	// #13 — durable digest outbox (Vikunja #281). A care nudge the restraint
+	// gate suppresses (quiet hours / away / calendar-busy) is not necessarily
+	// lost: if it's worth resurfacing, it lands here instead, and gets spoken
+	// as one bundle at the next moment speaking is appropriate. body_hash
+	// dedupes repeat suppressions of the "same" nudge; expires_ts bounds how
+	// stale an entry may get before it's worthless and must be dropped rather
+	// than delivered late.
+	`CREATE TABLE IF NOT EXISTS digest_entries (
+		id         INTEGER PRIMARY KEY AUTOINCREMENT,
+		rule       TEXT NOT NULL,
+		severity   INTEGER NOT NULL,
+		body       TEXT NOT NULL,
+		body_hash  TEXT NOT NULL,
+		status     TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','drained','expired')),
+		created_ts INTEGER NOT NULL,
+		expires_ts INTEGER NOT NULL
+	);
+	CREATE INDEX IF NOT EXISTS idx_digest_entries_status ON digest_entries (status);`,
 }
 
 // migrate applies every migration with a number greater than the DB's current