- Add /api/cron/sync route secured by x-cron-secret header
- Bypass NextAuth middleware for /api/cron/* routes
- Add CRON_SECRET to .env
- Fix FK violation: pass undefined instead of 'system' for triggered_by
- Systemd timer (ondeck-sync.timer) runs daily at 2 AM via curl