Fix cron jobs always 403ing: wire cronjob_pw through to the curl requests

CronjobsController requires a `cronpw` query param matching
AppModel.cronjob_pw, but cronjob_pw is generated at install time and
INSERTed straight into the DB -- nothing ever surfaced it to the cron
units' curl invocations, so every cron request has 403'd since this
service existed. Cache the value to a cfg.user-only-readable file at
generation time (backfilling it from the DB for already-installed
deployments), and have each cron unit read it back and append it as
`?cronpw=`.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/vm-test.nix

@@ -92,5 +92,12 @@ pkgs.testers.nixosTest {
     assert "/auth" not in final_url, (
         f"login didn't redirect away from /auth -- login failed (landed on {final_url}):\n{login_response}"
     )
+
+    # The cron units curl the app's own cronjob endpoints with a `?cronpw=`
+    # query param matching AppModel.cronjob_pw -- exercise one directly
+    # rather than just trusting it, since this exact wiring broke silently
+    # in production (every cron request 403'd, forever, with nothing short
+    # of reading the journal ever surfacing it) before this assertion existed.
+    machine.succeed("systemctl start hortusfox-cron-tasks-recurring.service")
   '';
 }