feat(CUST-WP-0014): repo sync automation & Gitea inventory

- Migration e2f3a4b5c6d7: add last_state_synced_at to managed_repos
- consistency_check.py: PATCH last_state_synced_at after fix run;
  fix ~ treated as non-empty state_hub_task_id (C-03 vs C-11);
  fix _inject_task_id_into_block skipping injection when field exists
  with null value
- install_hooks.sh: idempotent post-commit hook installer for all
  registered repos (make install-hooks REPO= / install-hooks-all)
- gitea_inventory.py: compare coulomb Gitea org against state-hub
  registered repos — registered / unregistered / hub-only sections
- infra/README.md: document systemd user timer + crontab fallback
- systemd user timer: custodian-sync.{service,timer} runs
  fix-consistency-all every 15 min (enabled)
- dashboard/src/repo-sync.md: Repo Sync Health page — sync age table,
  unregistered Gitea repos, hub-only repos
- api/routers/repos.py: GET /repos/{slug}/dispatch endpoint returning
  active goal, pending tasks per workstream, human interventions
- mcp_server/server.py: get_repo_dispatch() MCP tool

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infra/README.md

@@ -0,0 +1,89 @@
+# State Hub Infrastructure
+
+## Docker (PostgreSQL)
+
+```bash
+# Start postgres (required for API)
+make db
+
+# Start postgres + pgadmin
+make db-tools
+```
+
+The compose file is `infra/docker-compose.yml`. Copy `.env.example` to `.env` and set
+`POSTGRES_PASSWORD` before starting.
+
+---
+
+## Periodic Repo Sync — systemd user timer
+
+The custodian sync timer runs `fix-consistency-all` every 15 minutes, keeping
+workplan file state in sync with the state-hub DB automatically (belt-and-suspenders
+alongside the per-repo git post-commit hooks).
+
+### Installed unit files
+
+| File | Location |
+|------|----------|
+| `custodian-sync.service` | `~/.config/systemd/user/custodian-sync.service` |
+| `custodian-sync.timer`   | `~/.config/systemd/user/custodian-sync.timer`   |
+
+### Management commands
+
+```bash
+# Check status
+systemctl --user status custodian-sync.timer
+systemctl --user list-timers custodian-sync.timer
+
+# View recent logs
+journalctl --user -u custodian-sync.service -n 50
+
+# Trigger immediately (for testing)
+systemctl --user start custodian-sync.service
+
+# Disable
+systemctl --user disable --now custodian-sync.timer
+
+# Re-enable
+systemctl --user enable --now custodian-sync.timer
+```
+
+### Guard condition
+
+The service uses `ExecStartPre` to check the API is reachable before running:
+```
+ExecStartPre=/usr/bin/curl -sf http://127.0.0.1:8000/state/health
+```
+If the API is offline, the service exits cleanly without error (the timer will retry
+in 15 minutes).
+
+### WSL2 note
+
+systemd user mode works in WSL2 when `systemd=true` is set in `/etc/wsl.conf`.
+If systemd is not available, fall back to crontab:
+
+```bash
+# Crontab fallback (run crontab -e and add):
+*/15 * * * * curl -sf http://127.0.0.1:8000/state/health && cd ~/the-custodian/state-hub && .venv/bin/python scripts/consistency_check.py --all --fix >> /tmp/custodian-sync.log 2>&1
+```
+
+---
+
+## Post-commit hooks
+
+Each registered repo can have a custodian sync hook installed that triggers
+`fix-consistency` automatically after every commit:
+
+```bash
+# Install into one repo
+make install-hooks REPO=marki-docx
+
+# Install into all active registered repos
+make install-hooks-all
+
+# Remove from one repo
+make remove-hooks REPO=marki-docx
+```
+
+The hook is idempotent (guarded by `# custodian-sync-hook` marker) and runs
+in the background so it does not block the commit.