feat(system): daily-stats-email — Gen0Sec design, by-layer, rule type badges

[pigri]

Summary

Polishes the daily-stats-email system template (follow-up to #6):

• Gen0Sec design — inline-styled HTML body in the brand palette (headers #006fff, hero block-count, clean tables).
• By layer section — blocks per enforcement layer (waf, smart_firewall, access_rules, ids, …), so the summary isn't WAF-only. (top_rules stays WAF-only by nature; by_layer is how other layers surface.)
• Managed/custom rule badges — each top rule shows a green managed or purple custom chip, from the new type field.
• No duplicate heading — date moved into the branded card title.

Requires the daily_block_stats() function that emits by_layer + rule type (pigri/arxignis migration 20260609160000).

Verification

• Rendered against a sample payload (incl. a malicious <b> rule name → auto-escaped by data.template html mode).
• End-to-end: installed def updated + test message produced → redesigned email delivered (resend 200).