[FEAT] Add EmailService, RateLimitService, ReportService + integrations

Services:
- EmailService: CSIRT notifications (24h/72h/30d), training alerts, welcome email
- RateLimitService: File-based rate limiting for auth and AI endpoints
- ReportService: Executive HTML report, CSV exports (risks/incidents/controls/assets)

Integrations:
- AuthController: Rate limiting on login (5/min, 20/h) and register (3/10min)
- IncidentController: Email notifications on CSIRT milestones
- AuditController: Executive report and CSV export endpoints
- Router: 429 rate limit error handling, new audit export routes

Database:
- Migration 002: email_log table for notification tracking

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

public/js/api.js

@@ -238,6 +238,8 @@ class NIS2API {
     generateComplianceReport() { return this.get('/audit/report'); }
     getAuditLogs(params = {}) { return this.get('/audit/logs?' + new URLSearchParams(params)); }
     getIsoMapping() { return this.get('/audit/iso27001-mapping'); }
+    getExecutiveReportUrl() { return this.baseUrl + '/audit/executive-report'; }
+    getExportUrl(type) { return this.baseUrl + '/audit/export?type=' + type; }
 
     // ═══════════════════════════════════════════════════════════════════
     // Onboarding