ci: hourly monitor-refresh cron

[Movm]

Summary

• Adds .github/workflows/monitor-refresh.yml: POSTs to /api/internal/monitor/refresh every hour at :15
• Models on offboarding-daily.yml — same admin-token auth, same step-summary pattern, same concurrency safety
• No new secrets needed (secrets.ADMIN_TOKEN already exists from offboarding workflow)
• No backend or Salt changes required — endpoint already exists and is wired to requireAdminToken

Why

Before this, the monitor dashboard only updated when a logged-in user clicked the refresh button. Stale data would silently sit there until someone noticed. The two PRs that landed yesterday (#675 schema, #678 loud fails) made the refresh path reliable; this PR is the missing piece that actually triggers it.

Why GitHub Actions over an in-process scheduler

• Matches the existing house pattern (4 sibling cron workflows already do this kind of thing)
• Free observability: when the dashboard goes stale at 4 AM, the next dev's first instinct is to check the Actions tab
• Doesn't add a permanent daemon to the API container — easy to disable/reschedule without a deploy
• The :15 offset spreads load relative to the top-of-hour scrapers

Test plan

• After merge, manually run the workflow via Actions → Monitor Refresh → Run workflow to verify auth + endpoint reachability
• Confirm the step summary shows non-zero Total articles and Active topics
• Wait for the next :15 tick and confirm the scheduled run is green
• If the refresh path takes longer than 10 minutes in production, bump --max-time 600 and timeout-minutes: 15 accordingly