feat(server): retire scan scheduler for watcher + safety-net walk

Wire the fsnotify watcher and a fixed 12h safety-net delta walk in main;
remove the configurable scan scheduler (scheduler.go, scan_schedule table via
migration 0033, GET/PATCH /api/admin/scan/schedule, and the server/api
plumbing). Manual scan + scan status are unchanged.

internal/db/queries/scan_schedule.sql

@@ -1,18 +0,0 @@
--- name: GetScanSchedule :one
--- M7 recurring-scans: returns the singleton schedule row. Used by the
--- scheduler goroutine on boot and config-refresh, and by the admin GET
--- handler.
-SELECT mode, interval_hours, time_of_day, weekly_day, updated_at
-  FROM scan_schedule WHERE id = true;
-
--- name: UpdateScanSchedule :exec
--- Admin PATCH replaces the whole row; CHECK constraints enforce validity.
--- The application normalizes mode='off' to NULL the per-mode fields
--- before calling this.
-UPDATE scan_schedule
-   SET mode           = $1,
-       interval_hours = $2,
-       time_of_day    = $3,
-       weekly_day     = $4,
-       updated_at     = now()
- WHERE id = true;