feat(db/m7-recurring-scans): migration 0019 + sqlc queries

Adds the singleton scan_schedule table holding the operator's
recurring-scan config. mode is the discriminator (off/interval/
daily/weekly); CHECK constraints enforce per-mode field validity
(interval_hours required for interval; time_of_day for daily and
weekly; weekly_day 1..7 for weekly). Seed row is mode='off'.

Two new queries: GetScanSchedule (read singleton; used by scheduler
boot + admin GET) and UpdateScanSchedule (admin PATCH; application
normalizes per-mode fields to NULL when mode='off').

internal/db/queries/scan_schedule.sql

@@ -0,0 +1,18 @@
+-- name: GetScanSchedule :one
+-- M7 recurring-scans: returns the singleton schedule row. Used by the
+-- scheduler goroutine on boot and config-refresh, and by the admin GET
+-- handler.
+SELECT mode, interval_hours, time_of_day, weekly_day, updated_at
+  FROM scan_schedule WHERE id = true;
+
+-- name: UpdateScanSchedule :exec
+-- Admin PATCH replaces the whole row; CHECK constraints enforce validity.
+-- The application normalizes mode='off' to NULL the per-mode fields
+-- before calling this.
+UPDATE scan_schedule
+   SET mode           = $1,
+       interval_hours = $2,
+       time_of_day    = $3,
+       weekly_day     = $4,
+       updated_at     = now()
+ WHERE id = true;