feat: CAPA effectiveness re-check cron — 30/60/90-day email + WhatsApp notifications

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FFDuBhMKvoWjrWT3ZnGmmr

app/api/capa/[id]/verify/route.ts

@@ -28,10 +28,20 @@ export async function POST(
   if (body.verdict !== 'verified' && body.verdict !== 'reopened')
     return NextResponse.json({ error: 'verdict must be verified or reopened' }, { status: 422 })
 
+  const verifiedAt = new Date()
+  const recheckDate = new Date(verifiedAt)
+  recheckDate.setDate(recheckDate.getDate() + 30)
+
   const update: Record<string, unknown> = {
     status: body.verdict,
     verified_by: user.id,
-    verified_at: new Date().toISOString(),
+    verified_at: verifiedAt.toISOString(),
+    ...(body.verdict === 'verified'
+      ? {
+          effectiveness_recheck_date: recheckDate.toISOString().split('T')[0],
+          effectiveness_recheck_round: 0,
+        }
+      : {}),
   }
 
   const { error } = await supabase

app/api/cron/effectiveness-recheck/route.ts

@@ -0,0 +1,17 @@
+export const dynamic = 'force-dynamic'
+
+import { NextRequest, NextResponse } from 'next/server'
+import { createClient } from '@/lib/supabase/server'
+import { sendEffectivenessRecheckNotifications } from '@/lib/notifications/effectiveness-recheck'
+
+export async function GET(request: NextRequest) {
+  const auth = request.headers.get('authorization')
+  const expected = `Bearer ${process.env.CRON_SECRET}`
+  if (!auth || auth !== expected) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const supabase = await createClient()
+  const { notified } = await sendEffectivenessRecheckNotifications(supabase)
+  return NextResponse.json({ ok: true, notified })
+}