VOIP-1284-Migrate-tickers-to-schedule-manager

[pchero]

Phase 2 of bin-schedule-manager (VOIP-1283): migrates five in-process time.Ticker jobs — billing-manager monthly token top-up, billing-manager failed-event retry, ai-manager expired-proposal sweep, customer-manager unverified-customer cleanup, customer-manager frozen-customer expiry — into schedule-manager-dispatched RPC endpoints. All three touched services already run replicas:2 in production, so the double-fire hazard these tickers carried (no leader election, no lock) was live, not theoretical. Two real concurrency bugs found during investigation are fixed as part of this migration: AccountTopUpTokens had no CAS guard (ledger could double-insert under concurrent replicas); CustomerAnonymizePII had no status guard (could publish customer_deleted twice, double-triggering the number-manager/billing-manager cascade). VOIP-1282 (campaign-manager/queue-manager) concluded neither needs schedule-manager — both are already self-driving via RabbitMQ delayed-message self-RPC — so this PR does not touch them. Design approved over 3 review rounds, implementation plan over 6 rounds, code over 3 rounds (all Approve). No bin-common-handler changes: schedules dispatch generically via target_queue/target_uri, same as Phase 1's number-renew.

• bin-billing-manager: Fix AccountTopUpTokens to CAS-guard the monthly top-up (WHERE tm_next_topup is due; skip is not an error) and stop the ledger double-insert; add POST /v1/accounts/top_up; add POST /v1/failed_events/retry (RetryPending now reports retried/succeeded/exhausted counts); restructure cmd/billing-manager/main.go so the failed-event handler is built before the listen handler needs it; remove both ticker goroutines
• bin-ai-manager: Add POST /v1/aipromptproposals/expire (already CAS-guarded downstream, no dbhandler change); remove the proposal-expiry ticker; the two startup one-shot stale-recovery sweeps are untouched (per-boot, not a scheduler concern)
• bin-customer-manager: Fix CustomerAnonymizePII to guard on status=frozen, closing the duplicate customer_deleted publish; add POST /v1/customers/cleanup_unverified (also fixes an existing undercount — expired now reflects only successful updates) and POST /v1/customers/cleanup_frozen_expired; remove both ticker goroutines
• bin-dbscheme-manager: Seed the five new platform schedules (billing-monthly-topup hourly, billing-failed-event-retry every minute, ai-proposal-expiry hourly, customer-unverified-cleanup every 15 minutes, customer-frozen-expiry daily), all enabled

Sandbox replica-guard removal (scripts/voipbin-cli.py) is a separate, later PR in the sandbox repo, sequenced after these images are released and pinned — not part of this PR.