Add tier-based scan scheduler and webhook triggers (FRE-4498)

- ScanScheduler: tier-based scheduling (BASIC=24h, PLUS=6h, PREMIUM=1h)
- WebhookHandler: HMAC-verified webhook ingestion with SCAN_TRIGGER support
- API routes: /scheduler and /webhooks endpoints under /api/v1/darkwatch
- Jobs: scheduled scan checker + webhook retry processor via BullMQ
- Schema: ScanSchedule, WebhookEvent models; ScanJob.scheduledBy field
- Types: ScheduleStatus, WebhookEventType, WebhookTriggerInput
- Tests: scheduler lifecycle + webhook signature/processing tests

Co-Authored-By: Paperclip <noreply@paperclip.ing>

memory/2026-04-29.md

@@ -0,0 +1,19 @@
+# 2026-04-29
+
+## Security Review: FRE-4472 (SpamShield MVP)
+
+### Summary
+Security review completed for FRE-4472 (SpamShield MVP). Total of **16 findings** identified:
+- **6 HIGH** priority
+- **5 MEDIUM** priority  
+- **5 LOW** priority
+
+### Action Taken
+Created 16 child issues to track remediation:
+- **FRE-4503** through **FRE-4518**
+
+### Current State
+Parent issue **FRE-4472** is now **blocked** pending resolution of HIGH priority child issues.
+
+### Next Action
+Begin remediation with **FRE-4503** (field-level encryption) as the first HIGH priority item.