feat(reports): Excel renderer + attachment + archive download

render_excel(report): one worksheet per location — interval table, a line chart,
and a Last/Base/Δ summary per window. Metric-driven, so it tracks whatever metric
set is configured.

- orchestrator: render report.xlsx alongside report.html, attach it to the email
  (dry-run until SMTP set), expose xlsx_path. Never lets a spreadsheet error sink
  the report.
- reports router: /list includes xlsx_url when present; new
  GET /archive/{date}/xlsx serves the saved spreadsheet.
- UI: Recent-reports rows get an "Excel" download link.

Verified: real Feb data -> valid .xlsx (sheet per NRL, interval table + chart +
summary with real values), attachment path runs, both archive routes registered.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/services/report_orchestrator.py

@@ -23,8 +23,8 @@ from sqlalchemy.orm import Session
 from backend.services.report_pipeline import (
     ProjectNightReport, build_project_night_report, Window,
 )
-from backend.services.report_renderers import render_html_summary
-from backend.services.report_email import send_report_email, Attachment
+from backend.services.report_renderers import render_html_summary, render_excel
+from backend.services.report_email import send_report_email, Attachment, XLSX_MIME
 
 logger = logging.getLogger(__name__)
 
@@ -102,8 +102,20 @@ def run_nightly_report(
     json_path = out_dir / "report.json"
     json_path.write_text(json.dumps(_report_to_dict(report), indent=2), encoding="utf-8")
 
-    # --- Excel attachment (renderer not built yet — held until metric set is final) ---
+    # --- Excel (the email attachment; also written to disk for the archive) ---
     attachments: list[Attachment] = []
+    xlsx_path = None
+    try:
+        xlsx_bytes = render_excel(report)
+        xlsx_path = out_dir / "report.xlsx"
+        xlsx_path.write_bytes(xlsx_bytes)
+        safe_name = "".join(c for c in report.project_name if c.isalnum() or c in " -_").strip().replace(" ", "_")
+        attachments.append(Attachment(
+            f"{safe_name or 'report'}_{night_date:%Y-%m-%d}_night_report.xlsx",
+            xlsx_bytes, *XLSX_MIME,
+        ))
+    except Exception as e:  # noqa: BLE001 — never let the spreadsheet sink the report
+        logger.error("Excel render failed for %s (%s): %s", project_id, night_date, e, exc_info=True)
 
     # --- Email (best-effort; dry-run until SMTP is configured) ---
     email_result = {"sent": False, "dry_run": False, "skipped": True, "error": None}
@@ -120,6 +132,7 @@ def run_nightly_report(
         "location_count": len(report.locations),
         "html_path": str(html_path),
         "json_path": str(json_path),
+        "xlsx_path": str(xlsx_path) if xlsx_path else None,
         "html": html,            # for callers that want to display it inline
         "email": email_result,
     }