Run the periodic commands in a scheduler service (no host cron)

Adds deploy/scheduler-entrypoint.sh to the backend image (entrypoint
j621-scheduler) and a scheduler service to the four composes that have a
backend. It waits until the database and migrations are ready, runs every
job once, then keeps to the intervals:

  sync_followed_tags + sync_followed_pools   every 30 min (J621_SYNC_EVERY)
  cleanup_similarity                         hourly      (J621_CLEAN_EVERY)
  refresh_guest_blacklist                    daily       (J621_BLACKLIST_EVERY)

It shares the backend image, media volume and env file, so commands see
the same library and database; failures are logged and retried next
interval. Output goes to docker compose logs scheduler; the frontend-only
composes have no backend and therefore no scheduler.

Verified against a real stack: the scheduler waited for migrations, ran all
four commands on start (follow syncs as anonymous, similarity cleanup, and
a guest blacklist refresh that pulled the real 14-tag list from e621), and
kept looping. All six composes still validate.

AGENTS.md

@@ -41,6 +41,9 @@ Project constraints (do not regress):
   Gitea registry with deploy/push_*.sh (multi-arch, :latest + :sha, GIT_HASH
   baked in for the version pill); deploy/gen_env.sh generates .env with
   openssl secrets (--update keeps SECRET_KEY, --force rotates it).
+- Periodic commands (follow syncs, similarity cleanup, guest blacklist
+  refresh) run in the composes' `scheduler` service — the backend image with
+  the j621-scheduler entrypoint, intervals via J621_*_EVERY. No host cron.
 - Security/permission tests live in backend/apps/core/tests and need a
   one-time grant: GRANT ALL ON `test_j621`.* TO 'j621'@'%';