Add phaseflow-cron job and PocketBase admin credentials

- New periodic job for daily Garmin sync at 6 AM
- Added pocketbase_admin_email and pocketbase_admin_password to
  secrets template for cron job authentication

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

services/phaseflow.hcl

@@ -6,7 +6,9 @@
 #   nomad var put secrets/phaseflow \
 #     resend_api_key="re_xxxx" \
 #     encryption_key="$(openssl rand -hex 16)" \
-#     cron_secret="$(openssl rand -hex 32)"
+#     cron_secret="$(openssl rand -hex 32)" \
+#     pocketbase_admin_email="admin@example.com" \
+#     pocketbase_admin_password="your-admin-password"
 
 job "phaseflow" {
   datacenters = ["alo"]
@@ -66,7 +68,6 @@ job "phaseflow" {
         tags = [
           "traefik.enable=true",
           "traefik.http.routers.pocketbase-phaseflow.entryPoints=websecure",
-          "traefik.http.routers.pocketbase-phaseflow.middlewares=oidc-auth@file",
         ]
       }
     }
@@ -98,6 +99,8 @@ job "phaseflow" {
 RESEND_API_KEY={{ with nomadVar "secrets/phaseflow" }}{{ .resend_api_key }}{{ end }}
 ENCRYPTION_KEY={{ with nomadVar "secrets/phaseflow" }}{{ .encryption_key }}{{ end }}
 CRON_SECRET={{ with nomadVar "secrets/phaseflow" }}{{ .cron_secret }}{{ end }}
+POCKETBASE_ADMIN_EMAIL={{ with nomadVar "secrets/phaseflow" }}{{ .pocketbase_admin_email }}{{ end }}
+POCKETBASE_ADMIN_PASSWORD={{ with nomadVar "secrets/phaseflow" }}{{ .pocketbase_admin_password }}{{ end }}
 EOH
       }