Add phaseflow-cron job and PocketBase admin credentials

- New periodic job for daily Garmin sync at 6 AM
- Added pocketbase_admin_email and pocketbase_admin_password to
  secrets template for cron job authentication

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

services/phaseflow-cron.hcl

@@ -0,0 +1,42 @@
+# ABOUTME: Periodic batch job for PhaseFlow Garmin sync.
+# ABOUTME: Triggers daily sync at 6 AM to fetch fitness data and generate training recommendations.
+
+job "phaseflow-cron" {
+  datacenters = ["alo"]
+  type        = "batch"
+
+  periodic {
+    crons            = ["0 6 * * *"]
+    prohibit_overlap = true
+    time_zone        = "Europe/Lisbon"
+  }
+
+  group "garmin-sync" {
+    task "trigger" {
+      driver = "raw_exec"
+
+      config {
+        command = "/bin/sh"
+        args    = ["local/script.sh"]
+      }
+
+      template {
+        destination = "local/script.sh"
+        data        = <<EOH
+set -e
+/run/current-system/sw/bin/curl -s -f -X POST \
+  -H "Authorization: Bearer $CRON_SECRET" \
+  https://phaseflow.v.paler.net/api/cron/garmin-sync
+EOH
+      }
+
+      template {
+        destination = "secrets/env.env"
+        env         = true
+        data        = <<EOH
+{{- with nomadVar "secrets/phaseflow" -}}CRON_SECRET="{{ .cron_secret }}"{{- end -}}
+EOH
+      }
+    }
+  }
+}