I-003: job timeout reaper closes AwaitingCSR/AwaitingApproval gap

Add 11th always-on scheduler loop that transitions jobs stuck in
AwaitingCSR (default 24h TTL) or AwaitingApproval (default 168h TTL)
to Failed. I-001's retry loop then auto-promotes eligible Failed jobs
back to Pending. No new status enum, no schema migration.

- JobRepository.ListTimedOutAwaitingJobs with per-status cutoff WHERE
- JobService.ReapTimedOutJobs mirrors RetryFailedJobs structure
- Scheduler jobTimeoutLoop with atomic.Bool idempotency guard, 2m
  per-tick context, WaitGroup shutdown drain
- Config: CERTCTL_JOB_TIMEOUT_INTERVAL (10m), CERTCTL_JOB_AWAITING_CSR_TIMEOUT
  (24h), CERTCTL_JOB_AWAITING_APPROVAL_TIMEOUT (168h)
- Audit event per transition: actor=system, actorType=System,
  action=job_timeout, details={old_status, new_status, timeout_reason,
  age_hours}
- 14 new tests: 3 config, 7 service, 4 scheduler

cmd/server/main.go

@@ -469,6 +469,17 @@ func main() {
 			"sources", cloudDiscoveryService.SourceCount())
 	}
 
+
+	// Wire job timeout reaper (I-003)
+	sched.SetJobReaperService(jobService)
+	sched.SetJobTimeoutInterval(cfg.Scheduler.JobTimeoutInterval)
+	sched.SetAwaitingCSRTimeout(cfg.Scheduler.AwaitingCSRTimeout)
+	sched.SetAwaitingApprovalTimeout(cfg.Scheduler.AwaitingApprovalTimeout)
+	logger.Info("job timeout reaper enabled",
+		"interval", cfg.Scheduler.JobTimeoutInterval.String(),
+		"csr_timeout", cfg.Scheduler.AwaitingCSRTimeout.String(),
+		"approval_timeout", cfg.Scheduler.AwaitingApprovalTimeout.String())
+
 	// Start scheduler
 	logger.Info("starting scheduler")
 	startedChan := sched.Start(ctx)