feat: Implement Scheduler Worker Options and Planner Loop

- Added `SchedulerWorkerOptions` class to encapsulate configuration for the scheduler worker.
- Introduced `PlannerBackgroundService` to manage the planner loop, fetching and processing planning runs.
- Created `PlannerExecutionService` to handle the execution logic for planning runs, including impact targeting and run persistence.
- Developed `PlannerExecutionResult` and `PlannerExecutionStatus` to standardize execution outcomes.
- Implemented validation logic within `SchedulerWorkerOptions` to ensure proper configuration.
- Added documentation for the planner loop and impact targeting features.
- Established health check endpoints and authentication mechanisms for the Signals service.
- Created unit tests for the Signals API to ensure proper functionality and response handling.
- Configured options for authority integration and fallback authentication methods.

docs/ui/console.md

@@ -12,9 +12,10 @@ The Console AOC dashboard gives operators a live view of ingestion guardrails ac
 - **Route:** `/console/sources` (dashboard) with contextual drawer routes `/console/sources/:sourceKey` and `/console/sources/:sourceKey/violations/:documentId`.
 - **Feature flag:** `aocDashboard.enabled` (default `true` once Concelier WebService exposes `/aoc/verify`). Toggle is tenant-scoped to support phased rollout.
 - **Scopes:**
-  - `ui.read` (base navigation) and `advisory:verify` to view ingestion stats/violations.
-  - `vex:verify` to see Excititor entries and run VEX verifications.
-  - `advisory:write` / `vex:write` **not** required; dashboard uses read-only APIs.
+  - `ui.read` (base navigation) plus `advisory:read` to view Concelier ingestion metrics/violations.
+  - `vex:read` to see Excititor entries and run VEX verifications.
+  - `aoc:verify` to trigger guard runs from the dashboard action bar.
+  - `advisory:ingest` / `vex:ingest` **not** required; the dashboard uses read-only APIs.
 - **Tenancy:** All data is filtered by the active tenant selector. Switching tenants re-fetches tiles and drill-down tables with tenant-scoped tokens.
 - **Back-end contracts:** Requires Concelier/Excititor 19.x (AOC guards enabled) and Authority scopes updated per [Authority service docs](../ARCHITECTURE_AUTHORITY.md#new-aoc-scopes).
 

docs/ui/downloads.md

@@ -190,7 +190,7 @@ Telemetry entries include correlation IDs that match backend manifest refresh lo
 - `/docs/ui/sbom-explorer.md` - export flows feeding the downloads queue.  
 - `/docs/ui/runs.md` - evidence bundle integration.  
 - `/docs/24_OFFLINE_KIT.md` - offline kit packaging and verification.  
-- `/docs/security/console-security.md` - scopes, CSP, and download token handling (pending).  
+- `/docs/security/console-security.md` - scopes, CSP, and download token handling.  
 - `/docs/cli-vs-ui-parity.md` - CLI equivalence checks (pending).  
 - `deploy/releases/*.yaml` - source of container digests mirrored into the manifest.