feat(web): automation settings + in-app scheduler

[JustMaris]

Phase 3 of the automated-sends work: everything eraser schedule / eraser auto do, available from the web UI.

Settings → Automation card

• Schedule with my OS / Remove OS schedule installs or removes the launchd/systemd job. It goes through schedule.NewJob, the same checks as the CLI (the config must be valid, and a go run temp binary is refused).
• Run while this app is open / Turn off saves schedule.enabled. This is the fallback for Windows, or for anyone who doesn't want an OS job.
• Run now starts one cycle.
• The card shows the mode, the last run (time, what triggered it, how many sent, any error, read from auto-state.json) and the next run. In OS mode that's the next fixed 00/06/12/18:07 slot; in-app it's last run + 6h.
• It covers every profile, not just the active one, and says so on the card.

In-app scheduler (internal/web/scheduler.go)

• While schedule.enabled is set and no OS job is installed, serve runs eraser auto --once as a child process every 6 hours. Using the CLI cycle rather than a second copy in the web package means one send/scan path, one lock and one state file for every mode.
• It checks once a minute. It skips while a web send job is active or any cycle holds the lock. A recent run from any mode counts, so restarting serve doesn't trigger an extra cycle.

Double-send guards

• "Send all" returns 409 while a cycle is sending. The check and the job creation share a mutex with the scheduler's start, so the two can't pick the same brokers at the same moment.
• A job paused by the daily cap and resumed at startup now skips brokers sent since it paused. Before, it resent its whole stored remaining list without checking history.
• The pause message no longer says "restart tomorrow". It says automation will send the rest, or suggests turning automation on.

Other

• serve -p works. README and docs/commands.md documented it, but the flag had no shorthand.
• Docs, config.example.yaml and the schedule CLI help now cover the web option.

Verified in the browser against a dry-run config:

• turning on in-app automation saves the config;
• Run now → exactly one child cycle, and the card shows "via this web app";
• Schedule with my OS → the plist passes plutil -lint and points at the right binary and config → Remove leaves no plist and no loaded job.

Test plan: go vet ./... && go test ./..., and -race on web and schedule. New tests cover cycleDue (off, never run, recent, due, OS installed), the enable/disable toggle writing the config, install refusing an invalid config, Send all returning 409 while the lock is held, and NextOSRun. The test server now keeps the schedule lock and state in a temp dir with the OS scheduler hooks stubbed out, so tests never touch the real machine.