fix(archectl): write flow scheduler mode and run the flow daemon

[albertoperdomo2]

Summary

Fixes one-click deployments failing at web startup: archectl never wrote ARCHE_FLOW_SCHEDULER_MODE, and getFlowSchedulerMode() (apps/web/src/lib/flows/scheduler.ts) throws in production when the variable is missing — so every archectl-generated .env produced a web container that could not boot. The Ansible deploy path sets the variable correctly (infra/deploy/ansible/roles/app/templates/.env.j2:74); only the archectl path was broken.

Changes in infra/one-click/main.go:

• renderEnvFile and the renderBootstrapScript env heredoc write ARCHE_FLOW_SCHEDULER_MODE=daemon — the correct value for the one-click topology, which is remote-equivalent (same as the Ansible deploy_mode == 'remote' branch).
• renderUpdateScript sets the variable via the existing idempotent set_env helper, so existing deployments converge on their next update.
• renderCompose gains a flows service, and the update script brings flows up alongside web.

Why the compose service is part of the fix

Writing daemon alone would not be enough: startFlowDaemon() exits unless the mode is daemon, and in daemon mode the web process does not tick flows — a dedicated runner is expected. The new flows service mirrors the Ansible remote template exactly (same ${ARCHE_WEB_IMAGE} running ./node_modules/.bin/tsx src/flow-daemon.ts, same env file, networks, host mounts, health-gated depends_on, healthcheck disabled). The production image already ships src/ + node_modules/, so the entrypoint runs unchanged.

OpenSpec

Adds archectl-flow-scheduler-mode change with a new archectl-deployment capability spec (openspec/changes/archectl-flow-scheduler-mode/): generated env files must satisfy every production-required setting, the compose stack must run a runner consistent with the scheduler mode, and updates must converge existing deployments. Validated with openspec validate --strict.

Test plan

• go vet / gofmt clean; go test ./... — 16 passed (4 new: env template, bootstrap heredoc, update script set_env + up -d web flows, compose flows service)
• Rendered artifacts inspected: compose parses as valid YAML with services [docker-socket-proxy, flows, postgres, traefik, web]; env line and set_env present in rendered output
• openspec validate archectl-flow-scheduler-mode --strict — valid
• Manual: run archectl update against an existing one-click deployment and confirm the flows container starts and the web boots without the scheduler-mode error

Notes / follow-up

• archectl's compose also has no reaper service (Ansible remote runs one); pre-existing parity gap, deliberately left out of this fix to keep it scoped — happy to do it as a follow-up.
• No application code changes; no DB, env-infra, or Ansible changes.

Known failing check

Verify Web Coverage Badges is red due to a shared-main test bug, not this change: sessions-panel.test.tsx > groups sessions by date buckets is calendar-dependent and fails on the 31st (see the root cause in #498). Merge #498 first, then this branch rebases green.

[albertoperdomo2]

Superseded by #478, which absorbs this fix (ARCHE_FLOW_SCHEDULER_MODE in the env file, bootstrap heredoc, and update script, plus the flows daemon service) and additionally adds the reaper service to the one-click stack. Closing per the umbrella plan.