feat(schedules): make schedules pausable

Adds pause/resume support for scheduled prompts.

Backend:
- New paused_at_unix column on scheduled_prompts table (added via
  ALTER TABLE migration so existing databases are upgraded on first
  start). The due-rows index is dropped and recreated to also exclude
  paused rows so the worker never fires them while paused.
- Worker's due() query gains AND paused_at_unix IS NULL filter.
- New pause(id) and resume(id) methods on ScheduledPrompts; both are
  idempotent and refuse cancelled rows.
- New POST /api/schedules/{id}/pause and /api/schedules/{id}/resume
  dashboard endpoints (operator-direct, no approval gate). Both emit
  a schedules snapshot on success so the tab updates live.
- WireSchedule gains paused_at_unix: Option<i64> so the frontend can
  render the state without an extra fetch.

Frontend:
- Paused rows render with a distinct row class + muted opacity.
- The next-fire cell shows a yellow pause glyph + tooltip with the
  paused-since timestamp and the would-have-fired time.
- Actions column: pause/resume toggle button (⏸/▶) beside fire/edit/cancel.
  Fire-now is disabled while paused (resume first).
- Sort order: active → paused → cancelled (paused slot keeps schedules
  visible without mixing them into the active top section).
- pauseSchedule() / resumeSchedule() async functions POST to the new
  endpoints and refresh the table on success.

hive-sh4re/src/lib.rs

@@ -1395,6 +1395,12 @@ pub struct WireSchedule {
     pub source: WireScheduleSource,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub cancelled_at_unix: Option<i64>,
+    /// Set while the schedule is paused. Worker skips paused rows;
+    /// they keep their `next_fire_at_unix` so resuming at any time
+    /// fires at the next intended instant (no catch-up clamp needed
+    /// — a paused schedule simply slips its next fire).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub paused_at_unix: Option<i64>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub description: Option<String>,
     pub targets: Vec<WireScheduleTarget>,