fix: make runtime prefetch task registration executable end-to-end

SchedulerClient.register_volatile_fetch (consolidation's prefetch
routing) registered tasks that were dead on arrival:
- JSON body stored under 'body', which rest_api_executor ignores
  (it only reads config['payload'])
- no auth block, so the scheduled POST to /volatile/fetch would 401
  against library-desk's verify_api_key
- user placed in the body while /volatile/fetch endpoints require it
  as a query parameter (RequiredUserQuery) - would 422 regardless

The task config now carries user in the URL query string (encoded),
an empty payload, and auth {type: bearer, token: ${LIBRARY_API_KEY}}
substituted Scheduler-side (never stored raw).

SchedulerClient also sent no Authorization to the Scheduler API itself,
so registration 401'd silently at consolidation time; it now sends
Bearer auth from the new scheduler_api_key setting.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QbFZyDvYksazX6nYQYZ67L

src/core/dependencies.py

@@ -259,7 +259,10 @@ def get_scheduler_client() -> SchedulerClient:
     Note: Used for registering prefetch tasks discovered during HybridRAG searches
     """
     settings = get_settings()
-    client = SchedulerClient(base_url=settings.scheduler_url)
+    client = SchedulerClient(
+        base_url=settings.scheduler_url,
+        api_key=settings.scheduler_api_key,
+    )
     logger.debug(f"Created Scheduler client: {settings.scheduler_url}")
     return client