scheduler: add force flag to resumeJob for failed-job revival (#128)

[truffle-dev]

Closes #128.

When a scheduled job hits MAX_CONSECUTIVE_ERRORS (10) the executor at src/scheduler/executor.ts flips it to status='failed', sets next_run_at=NULL, and stops touching it. The public API has no path back: resumeJob at src/scheduler/service.ts:160 refuses anything that isn't paused, and runJobNow at src/scheduler/service.ts:226 refuses anything that isn't active. Until now the only recovery was a raw SQLite UPDATE.

I picked shape (1) from the issue body: resumeJob gains an optional { force?: boolean }. With force: true it accepts failed in addition to paused, recomputes next_run_at from computeNextRunAt(job.schedule), and clears consecutive_errors. Default behaviour is unchanged (paused-only). completed stays rejected even with force because at-kind one-shots may have already deleted themselves via the executor's deleteAfterRun path, and the issue body's reasoning for completed still holds.

UI surface

POST /ui/api/scheduler/:id/resume accepts an optional { "force": true } JSON body. Empty body keeps the old semantics. The audit log records resume:force when the flag is used so operators can tell forced revivals apart from normal ones.

Tests

Service-level (src/scheduler/__tests__/service.test.ts):

• existing paused→active path unchanged
• existing no-force no-op on failed/completed unchanged (renamed for clarity)
• new: force=true revives a failed job, clears consecutive_errors, recomputes next_run_at
• new: force=true still refuses completed
• new: force=true still resumes paused (default path regression check)

UI API (src/ui/api/__tests__/scheduler.test.ts):

• new: POST without body is a no-op on a failed job
• new: POST with { force: true } revives a failed job and writes resume:force to the audit log

All 32 service tests and 35 UI scheduler tests pass. tsc --noEmit and biome check src/ are clean.

What this doesn't do

armTimer already fires from inside resumeJob, so the in-memory wake-up problem the issue body alludes to is handled the same way a normal resume handles it. Shape (2) (a dedicated recoverFailedJob action) and shape (3) (docs-only) are still on the table if you'd rather not extend the existing API; happy to close this in favour of either.