WP-02: encrypted settings, SMTP mail, job runner and cron scheduler

AES-256-GCM secret storage keyed by MASTER_KEY, SMTP settings with test mail
(lettre), persisted job runs with log and status, JobRunner with per-kind
concurrency guard, 6-field cron schedules with defaults, scheduler loop.
Settings and Jobs pages in the UI. FAKE_HOST mode for dev machines.

Tests: 30 application, 8 infrastructure, 23 API, 16 Vitest, 6 Playwright.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

frontend/src/components/AppShell.vue

@@ -9,6 +9,7 @@ const nav = [
   { to: '/updates', label: 'Updates' },
   { to: '/vulnerabilities', label: 'Vulnerabilities' },
   { to: '/backups', label: 'Backups' },
+  { to: '/jobs', label: 'Jobs' },
   { to: '/users', label: 'Users', admin: true },
   { to: '/settings', label: 'Settings' },
 ]