REST API 5/6: REST read-only for alert schedules

[GonzoSpire]

Part of #1347.

Scope

Attribute-routed controller exposing on /api/alertSchedules:

• GET list, GET by id — read-only.
• Reuse IAlertScheduleProvider / AlertScheduleProvider and the models under src/server/HSMServer.Core/Model/Policies/.
• Permissions: same as the key owner has in the web UI.

Write operations are explicitly out of scope (schedule parser/timezone complexity — follow-up).

Acceptance criteria

• List and get return the same data the web UI shows, within owner permissions.
• Pagination on the list endpoint.

[saetto]

✅ Manually tested GET /api/v1/alertSchedules (list) and confirmed no write endpoints exist for schedules in v1. Locally there are no schedules configured, so the list returns an empty 200 for a caller who can see products/folders.

The interesting case — the global-scope caller-wide gate (CanSeeAnyBoundary) — is confirmed with a non-admin user with zero product/folder roles ("viewer_user"): GET /api/v1/alertSchedules answers 403 {"error":"forbidden","message":"The token's owner cannot see any product or folder."}, identically on both a read-write and a read-only token for that user (the read-only flag only affects writes, not this read-side gate). Contrasts correctly with per-item folder-sight (alertTemplates), which silently returns an empty list instead of 403 for the same user.

All as specced, no findings.