feat(netbird): auto-renew NetBird client-update API tokens before expiry

The tokens captured for central update control expire (NetBird enforces a
365-day max on Personal Access Tokens), and nothing was renewing them —
discovered that the 47 tokens created via the browser-automation bulk
onboarding were actually only 30-day tokens (left the UI's default
expiration field untouched instead of setting 365), so they would have
silently broken automatic-update control next month with no warning.

- Bumped all existing tokens to fresh 365-day ones via the API (using the
  still-valid old token as bearer — no re-login needed)
- Added netbird_api_token_renewed_at per deployment
- Scheduler now checks daily and renews any token older than 300 days
  automatically, so this never needs to be done by hand again

app/services/netbird_service.py

@@ -348,9 +348,9 @@ async def deploy_customer(db: Session, customer_id: int) -> dict[str, Any]:
             deployment.setup_url = setup_url
             deployment.netbird_admin_email = encrypt_value(admin_email) if setup_ok else deployment.netbird_admin_email
             deployment.netbird_admin_password = encrypt_value(admin_password) if setup_ok else deployment.netbird_admin_password
-            deployment.netbird_api_token_encrypted = (
-                encrypt_value(netbird_api_token) if netbird_api_token else deployment.netbird_api_token_encrypted
-            )
+            if netbird_api_token:
+                deployment.netbird_api_token_encrypted = encrypt_value(netbird_api_token)
+                deployment.netbird_api_token_renewed_at = datetime.utcnow()
             deployment.deployment_status = "running"
             deployment.deployed_at = datetime.utcnow()
         else:
@@ -366,6 +366,7 @@ async def deploy_customer(db: Session, customer_id: int) -> dict[str, Any]:
                 netbird_admin_email=encrypt_value(admin_email) if setup_ok else None,
                 netbird_admin_password=encrypt_value(admin_password) if setup_ok else None,
                 netbird_api_token_encrypted=encrypt_value(netbird_api_token) if netbird_api_token else None,
+                netbird_api_token_renewed_at=datetime.utcnow() if netbird_api_token else None,
                 deployment_status="running",
                 deployed_at=datetime.utcnow(),
             )