P2-02 (server side): schedule reconciliation push + ack handling

Server is now the source of truth for the agent's cron set.

* Helpers in schedule_push.go:
  - loadScheduleSetPayload reads the host's schedules + canonical
    version into the wire shape.
  - pushScheduleSetOnConn writes directly to a just-handshaken conn
    (avoids racing against Hub.Register on a brand-new connection).
  - pushScheduleSetAsync is the post-CRUD flavour — no-op when the
    host is offline (the next reconnect's on-hello path catches it
    up, so a missed push is non-fatal).
  - applyScheduleAck records what version the agent has confirmed.

* onAgentHello restructured: was returning early when the host had
  no repo credentials, which made the schedule push unreachable for
  fresh hosts. Split into pushRepoCredsOnHello (silent no-op on
  ErrNotFound) + pushScheduleSetOnConn (always runs). Empty schedule
  list is a valid push: tells the agent to drop stale cron entries.

* WS dispatcher gains an OnScheduleAck hook on HandlerDeps; the
  http server wires it to applyScheduleAck. MsgScheduleAck moves
  out of the "TODO(P2)" group into a real case that decodes the
  payload and forwards to the callback.

* Schedule CRUD handlers each fire pushScheduleSetAsync after the
  audit-log write so the agent picks up changes within seconds.

Tests cover:
  - On-hello push of an already-created schedule, agent acks,
    applied_schedule_version flips on the host row.
  - Connect-then-CRUD: empty initial push (version 0), then a
    follow-on push at version 1 after the operator creates a
    schedule via REST.

Agent-side `schedule.set` handler (parse, replace local cron,
emit `schedule.ack`) is the remainder of P2-02 and lands with
P2-03's local scheduler.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/server/http/schedules.go

@@ -141,6 +141,7 @@ func (s *Server) handleCreateSchedule(w stdhttp.ResponseWriter, r *stdhttp.Reque
 		TargetID:   &row.ID,
 		TS:         nowUTC(),
 	})
+	s.pushScheduleSetAsync(hostID)
 	writeJSON(w, stdhttp.StatusCreated, toScheduleAPI(row))
 }
 
@@ -207,6 +208,7 @@ func (s *Server) handleUpdateSchedule(w stdhttp.ResponseWriter, r *stdhttp.Reque
 		TargetID:   &existing.ID,
 		TS:         nowUTC(),
 	})
+	s.pushScheduleSetAsync(hostID)
 	writeJSON(w, stdhttp.StatusOK, toScheduleAPI(*existing))
 }
 
@@ -239,6 +241,7 @@ func (s *Server) handleDeleteSchedule(w stdhttp.ResponseWriter, r *stdhttp.Reque
 		TargetID:   &scheduleID,
 		TS:         nowUTC(),
 	})
+	s.pushScheduleSetAsync(hostID)
 	w.WriteHeader(stdhttp.StatusNoContent)
 }