feat: Implement Scheduler Worker Options and Planner Loop

- Added `SchedulerWorkerOptions` class to encapsulate configuration for the scheduler worker.
- Introduced `PlannerBackgroundService` to manage the planner loop, fetching and processing planning runs.
- Created `PlannerExecutionService` to handle the execution logic for planning runs, including impact targeting and run persistence.
- Developed `PlannerExecutionResult` and `PlannerExecutionStatus` to standardize execution outcomes.
- Implemented validation logic within `SchedulerWorkerOptions` to ensure proper configuration.
- Added documentation for the planner loop and impact targeting features.
- Established health check endpoints and authentication mechanisms for the Signals service.
- Created unit tests for the Signals API to ensure proper functionality and response handling.
- Configured options for authority integration and fallback authentication methods.

docs/deploy/console.md

@@ -206,7 +206,7 @@ Troubleshooting steps:
 - `deploy/helm/stellaops/values-*.yaml` - environment-specific overrides.  
 - `deploy/compose/docker-compose.console.yaml` - Compose bundle.  
 - `/docs/ui/downloads.md` - manifest and offline bundle guidance.  
-- `/docs/security/console-security.md` (pending) - CSP and Authority scopes.  
+- `/docs/security/console-security.md` - CSP and Authority scopes.  
 - `/docs/24_OFFLINE_KIT.md` - Offline kit packaging and verification.  
 - `/docs/ops/deployment-runbook.md` (pending) - wider platform deployment steps.
 
@@ -226,4 +226,3 @@ Troubleshooting steps:
 ---
 
 *Last updated: 2025-10-27 (Sprint 23).* 
-

docs/deploy/containers.md

@@ -68,7 +68,7 @@ Ensure `AOC_VERIFIER_USER` exists in Authority with `aoc:verify` scope and no wr
 clients:
   - clientId: stella-aoc-verify
     grantTypes: [client_credentials]
-    scopes: [aoc:verify, advisory:verify, vex:verify]
+    scopes: [aoc:verify, advisory:read, vex:read]
     tenants: [default]
 ```