feat: add pos system health, lib/notify.sh, and daily Telegram digest timer

- bin/pos-system-health: host dashboard (disk, RAM, failed units, backup age,
  fail2ban, docker); exits 1 on any FAIL; --send/--markdown via Telegram
- lib/notify.sh: self-contained opt-in alerting helper; silent-fails, wired
  into pos-system-backup (success + ERR trap) and pos-system-firewall
- systemd/pos-health.{service,timer}: 08:00 digest as installing user;
  postinstall enables timer once telegram.env exists, now copies *.timer
- AGENT_TODO.md: worklist with Now/Next/Later/Done history; linked from AGENTS.md

systemd/pos-health.service

@@ -0,0 +1,9 @@
+[Unit]
+Description=POS Health digest (daily report via Telegram)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=__POS_USER__
+ExecStart=/usr/local/bin/pos system health --send --markdown

systemd/pos-health.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Daily POS health digest timer
+
+[Timer]
+OnCalendar=*-*-* 08:00:00
+Persistent=true
+
+[Install]
+WantedBy=timers.target