feat: add an interval scheduler for auto scan and sync

[WhiteMuush]

What

Adds interval-based scheduling so exposure scans and directory syncs run in the background, not only on manual POST. Closes #53.

Design

"Internal cron + table", no dedicated worker and no heavy dependency: schedule state lives in the DB and a single tick endpoint advances it; an external cron calls the endpoint.

How

• Schema: DirectoryConnection.autoSyncIntervalMinutes (per connection), Company.scanIntervalMinutes + lastScanAt (per company). null disables; values are integers ≥ 5 minutes. Migration included.
• lib/scheduler.runDueSchedules: enqueues a SyncJob for each connection whose interval has elapsed (SCIM excluded, it is push-based), starts a scan for each due company that has providers configured (lastScanAt stamped up front to avoid double-trigger), then drains the sync queue via processSyncJobs (Move sync out of the request cycle: jobs + retry #54 retry/backoff).
• POST /api/cron: tick endpoint, CRON_SECRET bearer (timing-safe compare), 503 when unconfigured. See docs/scheduler.md for cron setup.
• Config: PATCH /api/directory/:id (auto-sync interval, rejects SCIM) and PATCH /api/company (scan interval), both admin + company-scoped.

Tests

isDue, runDueSchedules (due/not-due enqueue, scan only with providers, queue drain), cron auth (503/401/200), and both config endpoints (validation, scoping, SCIM rejection, null disable).

Notes

• Migration authored by hand (no local DB); prisma validate passes, client generates. prisma migrate deploy on deploy.
• Directory sync is durable (queued/retried). Auto-scan currently runs detached and is retried on the next due tick rather than via a job queue; a scan job queue can follow.

Closes #53

🤖 Generated with Claude Code