Add per-node action groups with schedules, runs, and logs.

Let operators manage ordered action groups on each host, run them manually or on a schedule over SSH, and inspect disk-backed JSON run logs from a node detail UI.

service/internal/api/setup_auth_handlers.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"codeberg.org/SquidSE/ClusterCanvas/service/internal/auth"
+	"codeberg.org/SquidSE/ClusterCanvas/service/internal/runner"
 	"codeberg.org/SquidSE/ClusterCanvas/service/internal/settings"
 )
 
@@ -79,6 +80,7 @@ type App struct {
 	ConfigDir string
 	Key       []byte
 	Sessions  *auth.SessionManager
+	Executor  *runner.Executor
 
 	pendingTOTPMu sync.Mutex
 	pendingTOTP   map[string]string // username -> secret (setup only)
@@ -88,17 +90,21 @@ func newApp(configDir string) (*App, error) {
 	key, err := settings.KeyFromEnv()
 	if err != nil {
 		// Key is required for setup complete / auth; status still works without it.
-		return &App{
+		app := &App{
 			ConfigDir:   configDir,
 			pendingTOTP: map[string]string{},
-		}, nil
+			Executor:    runner.NewExecutor(configDir, nil),
+		}
+		return app, nil
 	}
-	return &App{
+	app := &App{
 		ConfigDir:   configDir,
 		Key:         key,
 		Sessions:    auth.NewSessionManager(configDir, key),
 		pendingTOTP: map[string]string{},
-	}, nil
+		Executor:    runner.NewExecutor(configDir, key),
+	}
+	return app, nil
 }
 
 func (app *App) requireKey() error {