Add scheduled analysis prompts

[jusso-dev]

Problem

Some analyst questions recur daily or hourly: which rules are noisy, which cases are stale, which sources stopped sending logs, and which high-risk entities are trending. These should be scheduled instead of manually repeated.

Scope

Add scheduled analysis prompts that run with the creator permissions and produce saved analysis results.

Implementation Notes

• Add soc_scheduled_analysis and soc_scheduled_analysis_run.
• Fields: name, prompt, schedule, enabled, creatorId, tenantId, lastRunAt, nextRunAt, lastStatus.
• Initial prompt templates: noisy rules in the last 24 hours, stale critical/high cases, ingestion health summary, unresolved alerts by assignee, new external IPs in high-severity alerts.
• Run through existing cron/instrumentation path.
• If creator permissions are reduced or the account is disabled, disable the scheduled analysis.

Acceptance Criteria

• Users can create, enable, disable, edit, and delete scheduled analyses.
• Runs execute with creator-scoped permissions.
• Failed runs show error details.
• Latest run output is visible from the scheduled analysis detail page.
• Scheduled analyses do not perform write actions.

Tests

• Unit test schedule parsing and next-run calculation.
• Unit test disabled users or reduced permissions disable future runs.
• Integration test scheduled run creates an analysis result.
• API test users cannot access another tenant scheduled analyses.