feat(v5): add server reconciliation and canvas APIs

Split V5 dashboard behavior into domain controllers and policies,
add agent token rotation/revocation, status reconciliation jobs,
ingress firewall syncing, and canvas connection APIs.

Add migrations for V5 status tracking, server capabilities, resource
connection aliases, and revoked agent tokens.

app/Console/Kernel.php

@@ -15,6 +15,8 @@ use App\Jobs\RegenerateSslCertJob;
 use App\Jobs\ScheduledJobManager;
 use App\Jobs\ServerManagerJob;
 use App\Jobs\UpdateCoolifyJob;
+use App\Jobs\V5ReconcileServersJob;
+use App\Jobs\V5RotateAgentTokensJob;
 use App\Models\InstanceSettings;
 use Illuminate\Console\Scheduling\Schedule;
 use Illuminate\Foundation\Console\Kernel as ConsoleKernel;
@@ -49,6 +51,14 @@ class Kernel extends ConsoleKernel
         $this->scheduleInstance->command('sanctum:prune-expired --hours=1')->hourly()->onOneServer();
         $this->scheduleInstance->job(new ApiTokenExpirationWarningJob)->hourly()->onOneServer();
 
+        // V5 reconciliation loop: pull-based safety net for the push-only
+        // coold -> flux -> webhook status pipeline, plus container status pruning.
+        $this->scheduleInstance->job(new V5ReconcileServersJob)->everyFiveMinutes()->withoutOverlapping()->onOneServer();
+
+        // V5 host JWT rotation: re-mints and SSH-pushes a fresh host token
+        // before the on-disk token expires so coold reconnects stay authorized.
+        $this->scheduleInstance->job(new V5RotateAgentTokensJob)->hourly()->withoutOverlapping()->onOneServer();
+
         if (isDev()) {
             // Instance Jobs
             $this->scheduleInstance->command('horizon:snapshot')->everyMinute();