refactor(cron): migrate cron jobs to foundation scheduler

Replace custom goroutine-based scheduling in cron jobs with centralized
foundation scheduler. Each cron job now exposes a RunOnce method called
by the scheduler instead of managing its own ticker loop.

Changes:
- Remove interval/enabled config from cron job structs
- Convert Start() methods to RunOnce() for all cron jobs
- Add scheduler setup in main.go with configurable intervals
- Update foundation dependency to v0.6.0 for scheduler support
- Update tests to validate RunOnce nil-safety

internal/cron/token_refresh.go

@@ -32,17 +32,13 @@ type TokenRefresher struct {
 	db          *gorm.DB
 	rdb         *redis.Client
 	sync        *service.SyncService
-	interval    time.Duration
 	refreshSkew time.Duration
 	batchSize   int
 	maxRetries  int
 	httpClient  *http.Client
 }
 
-func NewTokenRefresher(db *gorm.DB, rdb *redis.Client, sync *service.SyncService, interval, refreshSkew time.Duration, batchSize, maxRetries int) *TokenRefresher {
-	if interval <= 0 {
-		interval = 30 * time.Minute
-	}
+func NewTokenRefresher(db *gorm.DB, rdb *redis.Client, sync *service.SyncService, refreshSkew time.Duration, batchSize, maxRetries int) *TokenRefresher {
 	if refreshSkew <= 0 {
 		refreshSkew = 50 * time.Minute
 	}
@@ -56,7 +52,6 @@ func NewTokenRefresher(db *gorm.DB, rdb *redis.Client, sync *service.SyncService
 		db:          db,
 		rdb:         rdb,
 		sync:        sync,
-		interval:    interval,
 		refreshSkew: refreshSkew,
 		batchSize:   batchSize,
 		maxRetries:  maxRetries,
@@ -64,25 +59,13 @@ func NewTokenRefresher(db *gorm.DB, rdb *redis.Client, sync *service.SyncService
 	}
 }
 
-func (t *TokenRefresher) Start(ctx context.Context) {
+// RunOnce executes a single token refresh cycle. Called by scheduler.
+func (t *TokenRefresher) RunOnce(ctx context.Context) {
 	if t == nil || t.db == nil {
 		return
 	}
-	if ctx == nil {
-		ctx = context.Background()
-	}
-	ticker := time.NewTicker(t.interval)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			if err := t.refreshOnce(ctx); err != nil {
-				slog.Default().Warn("token refresh failed", "err", err)
-			}
-		}
+	if err := t.refreshOnce(ctx); err != nil {
+		slog.Default().Warn("token refresh failed", "err", err)
 	}
 }