Reports: group, count and sum a client's own content, by role, with export and schedules

Comes up with almost every client: income by day, attendance by teacher this month, registrations by entry type, open tickets by status. barakoBrew has Analytics for site traffic, but nothing summarises a client's own content, so every report is an export into a spreadsheet or custom code.

## Change

**Report definitions**, saved per tenant:

- A content type, filters (the saved query filters, including choice values from #803 and the "without" filter from #835).
- Group by one or two fields, or a time bucket (`day`, `week`, `month`) in the tenant's time zone.
- Measures: `count`, `sum`, `avg`, `min`, `max` of numeric fields, including computed fields.
- A date range, fixed or relative (`today`, `last7days`, `thisMonth`).

**Running them.**
- `GET /api/reports/{name}?from=&to=` returns rows and totals, computed in the database, bounded by a group limit.
- Access follows the reader: a role sees only rows its row-level conditions allow (#827), and cannot group or measure on a field it may not read.
- Export as CSV; PDF once #585 exists.
- A report can be the `report` step of a workflow (#835) and emailed on a schedule (#255).

**Public figures.** A report marked public, over Public fields only, can feed a barakoPress chart or stat block (for example "1,240 runners registered"), cached like delivery.

**barakoBrew** (follow-up issue there): a report builder with a live preview, charts (bar, line, pie, table), and dashboard tiles a role can pin to their home screen.

## Done when

- Income by day for the last 30 days returns one row per day, including days with zero, in the tenant's time zone.
- A role limited to its own rows sees totals over only those rows.
- A report measuring a Sensitive field is refused for a role that cannot read it.

## Where it lives

Module: `BarakoCMS.Reports`, owning report definitions, their endpoints and the `report` workflow step. It builds on the core's query and permission services; the core does not reference it.

Start by reading the BarakoCMS.Reports module, especially its report-definition ownership, endpoints, and report workflow step, then trace the core query and permission services it builds on. Use the three Done when cases as acceptance checks: tenant-time-zone zero days, row-limited totals, and refusal of unreadable Sensitive fields; no specific files or tests are named.

Written by the indexing model from the issue text.