fix(quick-260721-fy8): reschedule mimecast-sync off the 2am cron collision

- Add migration 101: guarded UPDATE moving mimecast-sync from 0 2 * * * to
  45 4 * * * (minute 45 is unused by any other schedule row)
- Guarded on the stale cron value so it's a no-op if already moved and won't
  clobber an admin's manual schedule change
- Applied the same UPDATE directly to the live pulse-postgres container
  (migrations only auto-apply on first volume boot, per CLAUDE.md)
- Eliminates the 3-way 2 AM collision with qbo-sync-2am and veeam-full

migrations/101_reschedule_mimecast_sync.sql

@@ -0,0 +1,22 @@
+-- Migration 101: Reschedule mimecast-sync off the 0 2 * * * cron collision.
+--
+-- mimecast-sync was seeded at '0 2 * * *', the same slot as qbo-sync-2am and
+-- veeam-full. Because the sync-scheduler dispatch table had no branches for
+-- 'mimecast-sync' or 'qbo' (fixed alongside this migration), both jobs were
+-- silently falling through to the generic Autotask fullSync() catch-all,
+-- which meant they never ran their real sync logic AND contended with
+-- veeam-full for the SyncService singleton mutex — producing
+-- "A sync operation is already in progress" lock errors at 2 AM.
+--
+-- Moves mimecast-sync to 4:45 AM (minute 45 is unused anywhere in the live
+-- sync_schedules table — avoids 0 4 (contract-services, pax8-daily), 30 4
+-- (tickets-reconcile), the 15 * * * * hourly device-link job, and the
+-- */30 :00/:30 veeam jobs).
+--
+-- Guarded on the stale cron value so this is a no-op if already moved (safe
+-- to re-run) and won't clobber an admin's manual schedule change made via
+-- /admin after this ships.
+
+UPDATE sync_schedules
+SET cron_expression = '45 4 * * *', updated_at = NOW()
+WHERE id = 'mimecast-sync' AND cron_expression = '0 2 * * *';