feat(netbird): auto-renew NetBird client-update API tokens before expiry

The tokens captured for central update control expire (NetBird enforces a
365-day max on Personal Access Tokens), and nothing was renewing them —
discovered that the 47 tokens created via the browser-automation bulk
onboarding were actually only 30-day tokens (left the UI's default
expiration field untouched instead of setting 365), so they would have
silently broken automatic-update control next month with no warning.

- Bumped all existing tokens to fresh 365-day ones via the API (using the
  still-valid old token as bearer — no re-login needed)
- Added netbird_api_token_renewed_at per deployment
- Scheduler now checks daily and renews any token older than 300 days
  automatically, so this never needs to be done by hand again

app/routers/deployments.py

@@ -1,6 +1,7 @@
 """Deployment management API — start, stop, restart, logs, health for customers."""
 
 import logging
+from datetime import datetime
 
 from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException, Query, status
 from sqlalchemy.orm import Session
@@ -362,6 +363,7 @@ async def set_customer_netbird_api_token(
         )
 
     deployment.netbird_api_token_encrypted = encrypt_value(payload.token)
+    deployment.netbird_api_token_renewed_at = datetime.utcnow()
     db.commit()
     logger.info("NetBird API token registered for customer %d by %s.", customer_id, current_user.username)
     return {"ok": True}