Add Servers & Tasks module ported from Schedule Task Manager

Ports cron/systemd task tracking across Debian/Raspbian servers, including
the Linux push agent (install/report/uninstall scripts, rebranded from
"schedule-task-manager-agent" to "homelab-manager-agent") and the
manual-task-entry flow for things an agent can't see (Docker jobs, backups).
The schema (servers/scheduled_tasks tables) was already in place from the
foundation pass, so this is mostly a straight port of the original's
services/routes.

Deliberate change from the original: server/token management (which mints
agent credentials) is now admin-only rather than open to any logged-in user,
and manual task CRUD is gated to operator+ — consistent with how Secrets,
IPAM, and DNS already split "configure credentials" from "everyday edits"
across roles. All mutations are audit-logged.

- server/src/services/tokens.ts, taskSync.ts: ported near-verbatim (agent
  token hashing, the agent-sync-marks-missing-as-stale-not-deleted logic).
- server/src/routes/servers.ts, tasks.ts, agentReport.ts: same contract as
  the original (agent auth is a per-server bearer token, independent of the
  session-based requireAuth used everywhere else).
- web: a single Servers & Tasks page (filter bar, task table grouped by
  server/schedule type, manual task form, and an admin-only server
  management panel with token reveal + copyable install/uninstall commands),
  replacing the original's two separate pages/apps.

Verified: full build passes; a scripted HTTP test against a running server
covers unauthenticated access, role gating at each tier (admin-only server
mgmt, operator+ task mgmt), agent bearer-token auth (valid/invalid/rotated),
manual-vs-agent task edit protection, stale-marking on re-sync, and cascade
delete — 22/22 checks passing. Real agent installation on an actual
Debian/Raspbian host still needs to be tried on the user's network.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

agent/linux/install.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# Installs the Homelab Manager task-reporting agent as a systemd timer.
+#
+# Usage (must run as root — if not already root, put sudo right after the
+# pipe so it applies to bash, not to curl):
+#   curl -fsSL https://homelab.example.lan/agent/linux/install.sh | \
+#     sudo API_URL=https://homelab.example.lan API_TOKEN=hlm_xxx bash
+#
+set -euo pipefail
+
+: "${API_URL:?Set API_URL to your Homelab Manager URL, e.g. https://homelab.example.lan}"
+: "${API_TOKEN:?Set API_TOKEN to the per-server token generated on the Servers & Tasks page}"
+
+INSTALL_DIR="/usr/local/bin"
+CONFIG_DIR="/etc"
+SYSTEMD_DIR="/etc/systemd/system"
+INTERVAL_MINUTES="${INTERVAL_MINUTES:-15}"
+
+if [[ "$EUID" -ne 0 ]]; then
+  echo "This installer must be run as root (it installs a systemd timer)." >&2
+  echo "If you're piping from curl, put sudo right after the pipe so it elevates bash, not curl:" >&2
+  echo "  curl -fsSL ... | sudo API_URL=... API_TOKEN=... bash" >&2
+  exit 1
+fi
+
+suggest_package_install() {
+  local pkg="$1"
+  if command -v apt-get >/dev/null 2>&1; then
+    echo "  sudo apt-get update && sudo apt-get install -y $pkg"
+  elif command -v dnf >/dev/null 2>&1; then
+    echo "  sudo dnf install -y $pkg"
+  elif command -v yum >/dev/null 2>&1; then
+    echo "  sudo yum install -y $pkg"
+  elif command -v apk >/dev/null 2>&1; then
+    echo "  sudo apk add $pkg"
+  elif command -v pacman >/dev/null 2>&1; then
+    echo "  sudo pacman -S $pkg"
+  elif command -v zypper >/dev/null 2>&1; then
+    echo "  sudo zypper install -y $pkg"
+  fi
+}
+
+for bin in curl jq; do
+  if ! command -v "$bin" >/dev/null 2>&1; then
+    echo "Required dependency '$bin' is not installed. Try:" >&2
+    suggest_package_install "$bin" >&2
+    exit 1
+  fi
+done
+
+if ! command -v systemctl >/dev/null 2>&1; then
+  echo "systemctl was not found — this installer requires a systemd-based Linux distribution." >&2
+  exit 1
+fi
+
+echo "Installing Homelab Manager agent from $API_URL ..."
+
+curl -fsSL "$API_URL/agent/linux/report-tasks.sh" -o "$INSTALL_DIR/homelab-manager-agent.sh"
+chmod 755 "$INSTALL_DIR/homelab-manager-agent.sh"
+
+umask 077
+cat > "$CONFIG_DIR/homelab-manager-agent.env" <<EOF
+API_URL=$API_URL
+API_TOKEN=$API_TOKEN
+EOF
+chmod 600 "$CONFIG_DIR/homelab-manager-agent.env"
+
+cat > "$SYSTEMD_DIR/homelab-manager-agent.service" <<EOF
+[Unit]
+Description=Report scheduled tasks to Homelab Manager
+
+[Service]
+Type=oneshot
+EnvironmentFile=$CONFIG_DIR/homelab-manager-agent.env
+ExecStart=$INSTALL_DIR/homelab-manager-agent.sh
+EOF
+
+cat > "$SYSTEMD_DIR/homelab-manager-agent.timer" <<EOF
+[Unit]
+Description=Periodically report scheduled tasks to Homelab Manager
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=${INTERVAL_MINUTES}min
+Persistent=true
+
+[Install]
+WantedBy=timers.target
+EOF
+
+systemctl daemon-reload
+systemctl enable --now homelab-manager-agent.timer
+
+echo "Installed. Running an initial report now..."
+"$INSTALL_DIR/homelab-manager-agent.sh"
+
+echo "Done. The agent reports every ${INTERVAL_MINUTES} minute(s) via the 'homelab-manager-agent.timer' systemd timer."
+echo "To remove it later: curl -fsSL $API_URL/agent/linux/uninstall.sh | sudo bash"