Add manifest-managed service crons

[arjunkomath]

Summary

• add Vercel-style service.crons definitions to techulus.yml and reconcile them through tc apply
• dispatch bounded UTC cron occurrences through Inngest with at-most-once, zero-retry execution
• perform SSRF-protected public GET requests using CRON_BASE_URL and optional HTTPS Bearer CRON_SECRET
• retain the latest result on each cron and write execution history to VictoriaLogs
• show cron definitions and latest-run state in a read-only Configuration section

Safety and behavior

• GET only, no redirects, no retries, 10-second deadline
• DNS answers are validated as public and pinned for the request
• soft-deleted services and stale schedule events do not execute
• missed occurrences coalesce to the latest due occurrence
• dispatcher uses an indexed due cursor and a 100-row batch

Verification

• cd cli && go test ./...
• cd cli && go build ./...
• cd cli && test -z \"$(gofmt -l .)\"
• cd web && pnpm test — 65 files, 484 tests
• cd web && ./node_modules/.bin/tsc --noEmit
• cd web && pnpm lint — no errors; 7 existing React compiler warnings

Manual verification after deployment

• apply manifests with zero, one, and multiple crons and inspect Configuration
• confirm a one-minute cron sends exactly one GET with the optional Bearer header
• confirm latest status and cron service logs appear
• confirm missing base URL is skipped and redirects/non-2xx responses fail without retries

Basecamp: https://app.basecamp.com/5890597/buckets/47439993/todos/10143067635

[github-actions]

React Doctor found no issues. 🎉

⚠️ Warning: .github/workflows/react-doctor.yml is configured incorrectly. See below to fix.

React Doctor compares against main to report only the issues this pull request introduces. This run couldn't complete that comparison (usually a shallow CI checkout with no merge base), so it listed every issue in the changed files, including ones that already existed on main.

Add fetch-depth: 0 to the actions/checkout step in .github/workflows/react-doctor.yml so the checkout includes the history React Doctor needs:

 jobs:
   react-doctor:
     steps:
       - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0

       - uses: millionco/react-doctor@v2

To silence this warning, set silence-missing-baseline-warning: true on the React Doctor action.

_{Reviewed by React Doctor for commit c45bf7f.}