Funnel HomeKit + August (Yale) notifications into the pipeline

[jppaquet]

Context

Goal: surface Apple HomeKit events (door/window sensors, motion, etc.) and August smart-lock events (lock/unlock, low-battery, jammed) in the Notify inbox alongside backend alerts. Neither service exposes a clean webhook to a third-party URL out of the box.

The CloudEvents endpoint added in PR #113 is the right plug regardless of bridge — producers POST application/cloudevents+json with source: "homekit" or source: "august" after minting a per-source producer key.

Bridge options to evaluate

• Apple Shortcuts automation — "When sensor triggers → Get Contents of URL → POST". Runs on iPhone or Home Hub; no extra hardware. Lean on binary mode (ce-* headers) since Shortcuts can't easily form a structured-mode body.
• Home Assistant bridge — both HomeKit and August have first-class HA integrations; HA's rest_command or notify platform can POST a CloudEvent. Needs a Pi/NUC running 24/7.
• Homebridge plugin — narrower than HA but lighter; custom plugin emits CE on accessory events.
• Yale Access partner API — if developer access is feasible, server-side polling for August avoids the local-hub dependency on that half.

How to scope

Pick one bridge per source. New per-source backlog issues will likely follow once a path is chosen. Re-confirm with jpp before scoping into a PR.

Direction-of-travel only.