feat(scanning): scheduled scans (cron-like)

[Metbcy]

Problem

Today scans are one-shot — kicked off via POST /api/v1/scans from the dashboard, CLI, or webhook. Many users want recurring security audits without writing their own cron / GitHub Actions wrapper.

Acceptance criteria

• New schedules table: (id, name, target_path, scan_types, cron_expression, last_run, enabled, created_at).
• CRUD endpoints: POST/GET/PATCH/DELETE /api/v1/schedules (admin scope).
• Background worker (or APScheduler integration) that fires off a scan when a schedule's cron fires.
• UI under /settings/schedules to manage.
• Schedule history visible from the schedule's detail page.
• Documented in docs/src/scanning/.

Suggested approach

Use apscheduler (already a popular FastAPI-friendly choice). Persist schedules to SQLite, run the scheduler in the same process (single-worker constraint already documented).

For multi-worker: schedule must be claimed by exactly one worker — see #3 (multi-worker pubsub issue).

Difficulty

~1 day.