feat(server): retire scan scheduler for watcher + safety-net walk

Wire the fsnotify watcher and a fixed 12h safety-net delta walk in main;
remove the configurable scan scheduler (scheduler.go, scan_schedule table via
migration 0033, GET/PATCH /api/admin/scan/schedule, and the server/api
plumbing). Manual scan + scan status are unchanged.

internal/db/migrations/0033_drop_scan_schedule.down.sql

@@ -0,0 +1,21 @@
+-- Recreate the scan_schedule singleton (mirror of 0019) so the drop is
+-- reversible. The application no longer reads or writes this table.
+CREATE TABLE scan_schedule (
+    id             boolean PRIMARY KEY DEFAULT true,
+    mode           text NOT NULL DEFAULT 'off',
+    interval_hours int,
+    time_of_day    text,
+    weekly_day     int,
+    updated_at     timestamptz NOT NULL DEFAULT now(),
+    CONSTRAINT scan_schedule_singleton CHECK (id = true),
+    CONSTRAINT scan_schedule_mode_check
+        CHECK (mode IN ('off', 'interval', 'daily', 'weekly')),
+    CONSTRAINT scan_schedule_interval_check
+        CHECK (mode != 'interval' OR (interval_hours IS NOT NULL AND interval_hours > 0)),
+    CONSTRAINT scan_schedule_daily_check
+        CHECK (mode != 'daily' OR time_of_day IS NOT NULL),
+    CONSTRAINT scan_schedule_weekly_check
+        CHECK (mode != 'weekly' OR (time_of_day IS NOT NULL AND weekly_day IS NOT NULL AND weekly_day BETWEEN 1 AND 7))
+);
+
+INSERT INTO scan_schedule (id) VALUES (true);

internal/db/migrations/0033_drop_scan_schedule.up.sql

@@ -0,0 +1,4 @@
+-- Retire the configurable scan scheduler. New-file pickup is now handled by
+-- the fsnotify watcher + a hardcoded safety-net delta walk (cmd/minstrel),
+-- so the operator-configurable schedule (and its admin UI) is gone.
+DROP TABLE IF EXISTS scan_schedule;