feat(storage): both import jobs tick daily instead of manual-only

Registered with interval None, so they ran only when someone remembered
to trigger them — which was your objection to gating anything on
operator timing. Now daily.

Not boot-time: that would delay readiness for a filesystem walk, and
both jobs are idempotent and resumable, so periodic is strictly better.

The tick deliberately does NOT delete. `repair` defaults false, so
scheduled runs import and stop; unlinking stays a deliberate operator
action, per no-silent-auto-repair. That splits the two halves the way
their risk differs — the backfill is safe to automate, removing files is
not.

Cost once drained is a read_dir over three directories returning
nothing, and after the directory itself is removed, not even that.

src/infrastructure/services/thumb_attached_import_service.rs

@@ -89,8 +89,15 @@ impl ThumbAttachedImport {
         registry: &JobRegistry,
         provider: &Arc<dyn JobStoreProvider>,
     ) -> Arc<Self> {
+        // Daily, matching `thumb_derived_import` — and it does not delete on
+        // the tick either, since `repair` defaults false. See that job for
+        // the reasoning.
         registry
-            .register_recoverable_job(self.clone(), provider.clone(), None)
+            .register_recoverable_job(
+                self.clone(),
+                provider.clone(),
+                Some(std::time::Duration::from_secs(24 * 3600)),
+            )
             .await;
         self
     }

src/infrastructure/services/thumb_derived_import_service.rs

@@ -70,8 +70,22 @@ impl ThumbDerivedImport {
         registry: &JobRegistry,
         provider: &Arc<dyn JobStoreProvider>,
     ) -> Arc<Self> {
+        // Daily tick rather than manual-only. Ops cannot be relied on to
+        // remember a migration, and boot-time would delay readiness for a
+        // filesystem walk — whereas this is idempotent and resumable, so
+        // periodic is safe and it drains on its own.
+        //
+        // The tick does NOT delete: `repair` defaults false, so scheduled
+        // runs import and stop. Deletion stays a deliberate operator action,
+        // per no-silent-auto-repair. Once drained, a run is a `read_dir` over
+        // three directories that returns nothing — and after the directory is
+        // removed, not even that.
         registry
-            .register_recoverable_job(self.clone(), provider.clone(), None)
+            .register_recoverable_job(
+                self.clone(),
+                provider.clone(),
+                Some(std::time::Duration::from_secs(24 * 3600)),
+            )
             .await;
         self
     }