feat(dashboards): scheduler health strip, failing-source rollup, 24h activity sparkline, credential staleness nudge

D1 scheduler visibility: AppSetting last-tick stamp on every Beat tick +
GET /api/sources/schedule-status (last_tick_at/next_due_at/due_now/auto_sources)
+ SchedulerStatusBar on the Subscriptions tab (re-polled every 30s).

D2 failing-source rollup: ?failing=true on the sources list + FailingSourcesCard
on Downloads with per-source and bulk "retry" (re-runs the feed via /check).

D3 activity sparkline: GET /api/downloads/activity hourly buckets + CSS bar
chart by the stat chips (failures stacked in error color); refreshes on live poll.

D4 credential staleness: surface last_verified age + "re-verify recommended"
warning past 30d; also fixes the dead last_verified_at field-name mismatch so
the verification row renders at all.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/tasks/scan.py

@@ -18,7 +18,7 @@ from ..celery_app import celery
 from ..config import get_config
 from ..models import DownloadEvent, ImportBatch, ImportSettings, ImportTask
 from ..services.archive_extractor import is_archive
-from ..services.scheduler_service import select_due_sources
+from ..services.scheduler_service import record_tick, select_due_sources
 from ._sync_engine import sync_session_factory as _sync_session_factory
 
 
@@ -151,6 +151,8 @@ async def _tick_due_sources_async() -> dict:
     factory, engine = _async_session_factory()
     try:
         async with factory() as session:
+            # Prove the scheduler is alive even on empty ticks (UI reads this).
+            await record_tick(session)
             due = await select_due_sources(session)
             if not due:
                 return {