WP-02: encrypted settings, SMTP mail, job runner and cron scheduler

AES-256-GCM secret storage keyed by MASTER_KEY, SMTP settings with test mail
(lettre), persisted job runs with log and status, JobRunner with per-kind
concurrency guard, 6-field cron schedules with defaults, scheduler loop.
Settings and Jobs pages in the UI. FAKE_HOST mode for dev machines.

Tests: 30 application, 8 infrastructure, 23 API, 16 Vitest, 6 Playwright.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/api/src/main.rs

@@ -17,8 +17,9 @@ async fn main() -> anyhow::Result<()> {
         std::fs::create_dir_all(dir)?;
     }
     let pool = infrastructure::connect(&cfg.database_url).await?;
-    let state = AppState::new(cfg.clone(), pool);
+    let state = AppState::new(cfg.clone(), pool)?;
     state.bootstrap().await?;
+    state.start_scheduler();
     let listener = tokio::net::TcpListener::bind(cfg.bind).await?;
     tracing::info!("listening on http://{}", cfg.bind);
     let app = build_app(state).into_make_service_with_connect_info::<std::net::SocketAddr>();