feat: scheduler web+worker merge + audit Batch 1 (68 endpoints annotated)

Scheduler:
- Merge scheduler-worker into scheduler-web with Worker:Embedded flag
- Default embedded=true (compose), false available for K8s split
- Upgrade to resources-heavy, comment out scheduler-worker container

Audit Batch 1 (first real audit emission):
- Create AuditedRouteGroupExtensions convention helper
- EvidenceLocker: 7 endpoints (store/snapshot/verify/hold/export/verdict)
- Integrations: 6 endpoints (CRUD + test + discover)
- Scanner: 55 endpoints across 25 files
- Sprint 005 FILTER-001/002/003 marked DONE

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

devops/compose/scripts/backup.sh

@@ -13,7 +13,8 @@ mkdir -p "$OUT_DIR"
 docker compose ps >/dev/null
 
 echo "Pausing worker containers for consistency..."
-docker compose pause scanner-worker scheduler-worker taskrunner-worker || true
+docker compose pause scanner-worker || true
+# scheduler-worker merged into scheduler-web; taskrunner-worker removed
 
 echo "Backing up volumes..."
 docker run --rm \
@@ -23,6 +24,6 @@ docker run --rm \
   -v "$PWD/$OUT_DIR":/out \
   alpine sh -c "cd / && tar czf /out/stellaops-backup-$TS.tar.gz data"
 
-docker compose unpause scanner-worker scheduler-worker taskrunner-worker || true
+docker compose unpause scanner-worker || true
 
 echo "Backup written to $OUT_DIR/stellaops-backup-$TS.tar.gz"