feat: 接入企业微信通知（临期催办 + 群机器人汇总）

新增 lib/wecom-client.ts 与 lib/wecom-notifier-service.ts，支持
群机器人 webhook 与应用消息双通道；scheduler 加入临期 N 天催办
与每日管理员汇总；action 路由补 bind_wecom_external_id 与
send_test_wecom 两个管理端动作，配套测试。

lib/scheduler.ts

@@ -8,6 +8,11 @@ import {
 } from "./mcp-collection-client";
 import { ensureSchema, getRawDb } from "./mvp-db";
 import { getRuntimeEnv, isEnabled } from "./runtime-env";
+import {
+  resolveWecomConfig,
+  type WecomBindings,
+} from "./wecom-client";
+import { runDueSoonWecomNotifications } from "./wecom-notifier-service";
 
 declare global {
   var __kocLoopScheduler: ScheduledTask | undefined;
@@ -17,14 +22,31 @@ async function runDailyJob() {
   await withDatabaseLock("koc-loop-daily-collection", 0, async () => {
     await ensureSchema();
     const db = getRawDb();
+    const env = getRuntimeEnv();
     const config = resolveCollectionMcpConfig(
-      getRuntimeEnv() as unknown as CollectionMcpBindings,
+      env as unknown as CollectionMcpBindings,
     );
     const collections = await runScheduledCollections(db, Date.now(), config);
     const accounts = await backfillAccountProfiles(db, config, 10);
+    let wecom: Awaited<ReturnType<typeof runDueSoonWecomNotifications>> | null =
+      null;
+    if (isEnabled(env.WECOM_NOTIFY_ENABLED, true)) {
+      const wecomConfig = resolveWecomConfig(env as unknown as WecomBindings);
+      if (
+        wecomConfig.robotWebhook ||
+        (wecomConfig.corpId && wecomConfig.agentId && wecomConfig.secret)
+      ) {
+        try {
+          wecom = await runDueSoonWecomNotifications(db, wecomConfig);
+        } catch (error) {
+          console.error("[KOC LOOP] wecom notify failed", error);
+        }
+      }
+    }
     console.info("[KOC LOOP] daily scheduler completed", {
       collections,
       accounts,
+      wecom,
     });
   });
 }