feat(CUST-WP-0014): repo sync automation & Gitea inventory

- Migration e2f3a4b5c6d7: add last_state_synced_at to managed_repos
- consistency_check.py: PATCH last_state_synced_at after fix run;
  fix ~ treated as non-empty state_hub_task_id (C-03 vs C-11);
  fix _inject_task_id_into_block skipping injection when field exists
  with null value
- install_hooks.sh: idempotent post-commit hook installer for all
  registered repos (make install-hooks REPO= / install-hooks-all)
- gitea_inventory.py: compare coulomb Gitea org against state-hub
  registered repos — registered / unregistered / hub-only sections
- infra/README.md: document systemd user timer + crontab fallback
- systemd user timer: custodian-sync.{service,timer} runs
  fix-consistency-all every 15 min (enabled)
- dashboard/src/repo-sync.md: Repo Sync Health page — sync age table,
  unregistered Gitea repos, hub-only repos
- api/routers/repos.py: GET /repos/{slug}/dispatch endpoint returning
  active goal, pending tasks per workstream, human interventions
- mcp_server/server.py: get_repo_dispatch() MCP tool

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Makefile

@@ -1,4 +1,4 @@
-.PHONY: install install-cli db db-tools migrate seed api dashboard check start clean register-project validate-adr add-domain rename-domain add-repo list-repos cleanup-stale tunnel tunnel-daemon tunnel-loop tunnel-status tunnel-stop
+.PHONY: install install-cli db db-tools migrate seed api dashboard check start clean register-project validate-adr add-domain rename-domain add-repo list-repos cleanup-stale tunnel tunnel-daemon tunnel-loop tunnel-status tunnel-stop install-hooks install-hooks-all gitea-inventory
 
 COMPOSE = docker compose -f infra/docker-compose.yml --env-file .env
 
@@ -190,5 +190,24 @@ fix-consistency-all:
 cleanup-stale:
 	uv run python scripts/cleanup_stale_tasks.py
 
+## Install custodian post-commit sync hook into one repo: make install-hooks REPO=marki-docx
+install-hooks:
+	@test -n "$(REPO)" || (echo "ERROR: REPO is required. Usage: make install-hooks REPO=<slug>"; exit 1)
+	bash scripts/install_hooks.sh --repo "$(REPO)"
+
+## Install custodian post-commit sync hook into all active registered repos
+install-hooks-all:
+	bash scripts/install_hooks.sh --all
+
+## Remove custodian post-commit sync hook from one repo: make remove-hooks REPO=marki-docx
+remove-hooks:
+	@test -n "$(REPO)" || (echo "ERROR: REPO is required. Usage: make remove-hooks REPO=<slug>"; exit 1)
+	bash scripts/install_hooks.sh --repo "$(REPO)" --remove
+
+## Compare Gitea coulomb org repos against state-hub registered repos
+## Requires GITEA_TOKEN in env or .env: make gitea-inventory GITEA_TOKEN=<token>
+gitea-inventory:
+	uv run python scripts/gitea_inventory.py $(if $(JSON),--json)
+
 clean:
 	$(COMPOSE) down -v