feat: CAPA overdue escalation cron — 4 thresholds, once-per-threshold via notifications_log

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FFDuBhMKvoWjrWT3ZnGmmr

docs/vps-cron.md

@@ -0,0 +1,22 @@
+# VPS Cron Jobs
+
+## CAPA escalation
+
+Runs daily at 00:00 UTC (08:00 MYT). Checks all open CAPAs against 4 thresholds
+(`warning_3d`, `due_today`, `overdue_3d`, `overdue_7d`) and sends email via Resend.
+Each threshold fires once per CAPA, tracked in `notifications_log.status`.
+
+**Install (SSH into VPS):**
+```bash
+crontab -e
+# Add:
+0 0 * * * curl -s -H "Authorization: Bearer $(grep CRON_SECRET /ims/.env.local | cut -d= -f2)" http://localhost:3000/ims/api/cron/capa-escalation >> /var/log/ims-cron.log 2>&1
+```
+
+**Manual test:**
+```bash
+curl -s -H "Authorization: Bearer $CRON_SECRET" http://localhost:3000/ims/api/cron/capa-escalation
+# Expected: {"ok":true,"notified":N}
+```
+
+**Log:** `/var/log/ims-cron.log`