Bearer-authed cron: re-verify all active watches whose next_check_at has elapsed.

WO-5 background job. For each active watch whose next_check_at <= NOW(), run the canonical clearance pipeline, compare the canonical 3-value verdict against last_verdict, and insert a watch_events row with event_type='rechecked' or 'verdict_changed' as appropriate. Bumps next_check_at ahead by DEFAULT_NEXT_CHECK_DAYS. Webhook delivery is Sprint 2 proper — this endpoint only records events.