tic: run per-user under a system-agent scheduler, with a run log

Reframe TIC from an ownerless global loop into a per-user system agent.
The events it reads live in each user's own encrypted mcp_events, the
connectors that produced them run in that user's container, and the
notifications go to that user's hub — so the previous design (built
against the ownerless Conversation bundle, writing into system.db and
notifying a hub with no subscribers) was inert by construction.

Core changes
- TicManager owns no timer and no user list. It now exposes
  run_for(user_id, pool, sessions, hub): one tick for one user, over
  deps unpacked from that user's UserContext. Removed from the
  Conversation bundle; Skald::tic_manager() is gone.
- New spawn_system_agents in wiring.rs: one instance-wide loop, spawned
  post-construction with a Weak<Skald> (like spawn_user_lifecycle).
  Each pass walks the directory and runs TIC for one user at a time —
  sequential, because a pass is N container round-trips and N LLM calls
  nobody is waiting on. A ConfigKeyUpdated on the interval key cuts the
  current wait short; enabled is re-read per pass.
- A user whose database is still locked is skipped (normal, not an
  error): the pool is the unlock token, so a user who hasn't logged in
  since restart has no readable events and nowhere to record a skip.
- The configured tic.security_group is re-checked per user through
  run_context::reconcile_group_for_user — a restricted member never
  gets a tool set their role wouldn't grant; unconfigured starts from
  role_default_run_context, never None (None = catch-all = wider).
- New system_agent_runs owner table (no user_id column — the file is
  the owner): start/finish split so a crash leaves a visible 'running'
  row, swept to 'failed' by the next start; safe because the scheduler
  is sequential and single-instance. An idle tick writes nothing.
- counting_notify wraps the notify tool so the run log can report
  notifications emitted without the tool knowing it's counted.
- The session's event channel is drained by a spawned task instead of
  a dropped receiver — the translator awaits its sends and would wedge
  at capacity.

EventLog::{Persist,Discard} on McpManager::new
- mcp_events is an owner table and its only reader (TIC) is per-user,
  so an event is something that happened to someone. The per-user
  runtime gets Persist; the ownerless global runtime gets Discard (its
  pool is system.db, rows would be unattributable and unread).

API + UI
- GET /api/system-agents/runs: the caller's own run history, scoped
  through require_context with no admin override (same promise as the
  rest of the private pool).
- web/components/system-agents.js replaces tic-sessions.js. The old
  #tic debug page inferred runs from leftover ephemeral sessions; the
  new #system-agents page (sidebar group 'extensions', visible to
  everyone — the data is the caller's own) reads the real run log.
- i18n: tic.* keys replaced with system_agents.* in en/it/fr.

Docs
- New docs/system-agents.md (user-facing: what TIC does, why it runs
  per person, why a run can be missing). Updated docs/settings.md and
  docs/index.md.
- agents/tic/AGENT.md reframed per-user: events are that person's,
  memory is user-memory/ (private) — never shared-memory/.
- CLAUDE.md records the system-agents design and the EventLog seam.

web/i18n/en.js

@@ -25,7 +25,7 @@ export default {
   'nav.catalog':       'Connectors Catalog',
   'nav.config':        'Settings',
   'nav.llm_requests':  'LLM Requests',
-  'nav.tic':           'TIC Sessions',
+  'nav.system_agents': 'System agents',
 
   // ── Top bar ────────────────────────────────────────────────────────────────
   'topbar.profile':     'Profile',
@@ -182,18 +182,18 @@ export default {
   'config.set.interface.name':     'Interface',
   'config.set.interface.desc':     'Look and feel of the web interface.',
   'config.set.tic_agent.name':     'TIC Agent',
-  'config.set.tic_agent.desc':     'TIC is a background agent that monitors all async events generated by connected MCP servers (new emails, calendar updates, WhatsApp messages, etc.). It reads your notification rules from data/notifications.md and your memory to decide — via an LLM call — which events are worth surfacing. Relevant notifications are forwarded to the home agent set via /sethome.',
+  'config.set.tic_agent.desc':     'TIC is a background agent that runs for every user, one at a time. For each user it reads the events their own connectors have pushed since the last run (new mail, calendar changes, incoming messages), decides — via an LLM call — which of them are worth surfacing, and sends those to that user as notifications. It reads only that user\'s events and writes only to their own conversation; a user who has not logged in since the last restart is skipped, because their database is still encrypted. Each run is recorded on the System agents page, visible to the user it ran for.',
   'config.set.compaction.name':    'Compaction',
   'config.set.compaction.desc':    'When a conversation grows too large, older messages are summarised by an LLM to keep the context within limits.',
 
   'config.prop.ui_locale.name':             'Language',
   'config.prop.ui_locale.desc':             'Default interface language for the whole instance. Each user can override it on their profile.',
   'config.prop.tic__enabled.name':          'Enabled',
-  'config.prop.tic__enabled.desc':          'Enable or disable the TIC agent. When disabled, no MCP events are processed.',
+  'config.prop.tic__enabled.desc':          'Enable or disable the TIC agent for the whole instance. When disabled, no events are processed for anyone.',
   'config.prop.tic__security_group.name':   'Security Group',
-  'config.prop.tic__security_group.desc':   'Tool permission group applied to each TIC agent session. Leave empty to use the default group.',
+  'config.prop.tic__security_group.desc':   'Tool permission group applied to each TIC run. It is re-checked against each user\'s own role: a user whose role does not allow this group runs under their role\'s default group instead. Leave empty to always use the role default.',
   'config.prop.tic__interval_minutes.name': 'Check Interval (minutes)',
-  'config.prop.tic__interval_minutes.desc': 'How often TIC runs, in minutes. Leave empty to use the value from config.yml (tic.interval_secs).',
+  'config.prop.tic__interval_minutes.desc': 'How often TIC starts a pass over all users, in minutes. Leave empty to use the value from config.yml (tic.interval_secs).',
   'config.prop.compaction_model.name':      'Compaction model',
   'config.prop.compaction_model.desc':      'Model used to summarise compacted conversations, for the whole instance. A cheap model is usually enough. Leave empty for automatic selection.',
 
@@ -950,19 +950,30 @@ export default {
 
   'providers.confirm.delete':     'Delete provider "{name}"? All associated models will be deleted too.',
 
-  // ── TIC Sessions ────────────────────────────────────────────────────────────
-  'tic.title':              'TIC Sessions',
-  'tic.loading':            'Loading…',
-  'tic.empty':              'No TIC sessions found.',
-  'tic.total':              '{n} total',
-  'tic.refresh':            'Refresh',
+  // ── System agents ───────────────────────────────────────────────────────────
+  'system_agents.title':          'System agents',
+  'system_agents.subtitle':       'Background agents the assistant runs for you on a schedule. They read the events your connectors receive and notify you when something looks worth your attention.',
+  'system_agents.loading':        'Loading…',
+  'system_agents.empty':          'No runs yet.',
+  'system_agents.empty_hint':     'A run is recorded only when there are new events to look at.',
+  'system_agents.total':          '{n} total',
+  'system_agents.refresh':        'Refresh',
 
-  'tic.table.agent':        'Agent',
-  'tic.table.started':      'Started',
-  'tic.table.messages':     'Messages',
-  'tic.table.last_activity':'Last activity',
+  'system_agents.table.agent':    'Agent',
+  'system_agents.table.started':  'Started',
+  'system_agents.table.status':   'Status',
+  'system_agents.table.duration': 'Duration',
+  'system_agents.table.result':   'Result',
 
-  'tic.pagination':         'Page {cur} of {pages} — {total} sessions',
+  'system_agents.status.running':   'Running',
+  'system_agents.status.completed': 'Completed',
+  'system_agents.status.failed':    'Failed',
+  'system_agents.status.cancelled': 'Cancelled',
+
+  'system_agents.stat.events_processed':      'events',
+  'system_agents.stat.notifications_emitted': 'notifications',
+
+  'system_agents.pagination':     'Page {cur} of {pages} — {total} runs',
 
   // ── File viewer ─────────────────────────────────────────────────────────────
   'fv.back':                'Back',