Add a LinkedIn sync schedule that runs on the org's agent

[pallaoro]

Stacked on #18 (LinkedIn channel). Merge #18 first; this PR then retargets to main.

What

A LinkedIn sync page: pick the agent signed in to LinkedIn, pick how often, and turn it on. The app creates one schedule on that agent through @clawnify/agents. The agent's own scheduler keeps the time, and the app never runs a timer of its own.

Each run follows skills/linkedin-sync/SKILL.md, which a build step (scripts/build-linkedin-skill.mjs) snapshots into the schedule's task text with its hash:

1. Open a run.
2. Mirror new LinkedIn messages.
3. Send the queued LinkedIn messages (openers to 1st-degree connections only).
4. Close the run with counts, or with what LinkedIn showed.

Guarantees

• Consent: off until a person turns it on, because every run spends the agent's credits.
• Cadences: office hours only, weekdays 8:00–18:00: hourly (default), every 30 minutes, or every 10 minutes (labelled as costing the most).
  • Times use the saving browser's time zone.
• One run at a time: POST /api/linkedin-sync/runs is idempotent on the agent's run id. A partial unique index refuses a second open run (409), so an overlapping fire stops at its first call. A run that never reports back stops blocking after 45 minutes.
• Off means off: once sync is off, a run gets 410 even if the scheduler couldn't be reached to pause.
• One schedule:
  • Creation uses a stored idempotency key, so a retry after a timeout replays the same creation. Saving again updates the same schedule.
  • Moving to another agent deletes the old schedule first and stops, with a visible error, if that fails.
  • Off pauses the schedule; Remove deletes it.
• Who can do what:
  • Run routes are in the OpenAPI description and are agent-only.
  • The settings, agents, run-now and remove routes are left out of the description and need a signed-in person, so a task never teaches its agent to schedule or dispatch itself.
• Run now uses a request id kept by the browser, so a double click or retry dispatches once.

Checked

• pnpm test: 35 pass (including Add LinkedIn as a connections-only channel #18's), 12 new in tests/linkedin-sync.test.mjs. They run against the real worker in Miniflare with a fake agents API that records every call.
• The one-run-at-a-time test fails without the partial index. The agent-move test fails if the create goes ahead after the old schedule couldn't be removed.
• pnpm run typecheck and pnpm run build pass (both run the skill snapshot first).
• UI, locally:
  • The page renders, and the cadence dropdown uses the existing Popover + Command.
  • With no platform token, the agent picker shows "This app can't reach your agents yet".
  • No sideways scroll at 390px.
• Not run: a real schedule on a deployed app. That needs the platform token, which only a deployed app gets.