feat(event-triage): per-user check interval, overriding the instance one

Event triage is the one system agent whose right cadence depends on who it
runs for: it fires on inbound events, so someone on a dozen mailing lists
has something waiting on nearly every tick while a quiet account has
something waiting almost never. A single instance-wide interval serves one
of them badly, and the observed failure is the first: the agent starts on
practically every pass.

An admin can now set a per-person interval on that user's page (Users ->
the person -> Event triage). Empty means "follow the instance setting",
which stays the state nobody has a row for.

- New registry table `system_agent_user_settings(agent_id, user_id,
  interval_secs)`. A row is an override and its absence is inheritance --
  no sentinel value, no row seeded at user creation, clearing the field
  deletes the row. Registry rather than the user's own file because the
  writer is the admin and a member's database is unreadable unless they
  happen to be logged in; a setting that could only be changed during its
  subject's session would not be a setting. Keyed by agent_id though only
  one agent uses it, so a future agent's schedule is not a schema change.

- `SystemAgent` gains `interval_secs_for(user_id)`, which `is_due` now
  measures against, and `shortest_interval_secs()`. Both default to the
  existing `interval_secs`, so every other agent implements nothing. The
  second is the non-obvious half: `base_tick` sleeps for the shortest
  interval any enabled agent asks for, so without it an override below the
  instance value would be rounded up to it -- an override that works when
  it lengthens and silently does nothing when it shortens.

- `GET/PUT /api/users/{id}/event-triage`, admin-gated, minutes on the
  wire, null to clear. Nothing rides the bus: the scheduler re-reads the
  interval every tick and due-ness is counted from the user's own last
  attempt, so a change lands on the next wake-up with no push.

Both helpers fail open onto the instance value -- an unreadable registry
must not turn into an agent that stops running for someone.

Docs: docs/system-agents.md gains the per-person section and no longer
reads as if the interval were one number for everybody.

docs/system-agents.md

@@ -116,6 +116,20 @@ Each agent's tab carries the same three settings, visible only to an admin:
 
 - **Enabled** — turns that agent on or off for the whole instance, for everyone.
 - **Interval** — how long between passes for each person. Event triage is in minutes, the lints in days. The conversation review has **Run at (hour)** instead: it runs once a day, after that hour, local time — 4am by default, so the report is waiting in the morning.
+  For event triage this is a **default**, not a rule: see below.
 - **Security group** — which tools the agent may use during a run. It is re-checked against each user's own role: if their role does not allow that group, their run uses their role's default group instead. Nobody's background agent gets more access than their role would give them. (The conversation review ignores this in practice: it is given no tools whatsoever, so there is nothing for a group to permit.)
 
 For the first three there is no per-user on/off switch: if the agent is enabled, it runs for everyone who has logged in. The conversation review is the opposite — it runs for **nobody** until an admin creates a supervision link, and that link is what turns it on for one person.
+
+### Event triage: a different interval for one person
+
+Event triage is the one agent whose right cadence depends on **who** it is running for, because it fires on things arriving from outside. Somebody on a dozen mailing lists has something waiting on nearly every pass; somebody who gets three messages a week has something waiting almost never. One number for the whole household serves one of them badly.
+
+So that interval can be set per person: sidebar → **Users** → click the person → the **Event triage** section.
+
+- **Leave the field empty and they follow the instance setting**, whatever it is now and whatever it becomes later. That is the normal state, and nobody has a row until an admin types one.
+- **Type a number of minutes and it applies to that person only.** Longer is the usual reason — someone who was being interrupted too often gets an hour instead of fifteen minutes — but shorter works too.
+- The change takes effect at the next scheduled wake-up, within a few minutes. It never affects anyone else, and clearing the field puts them straight back on the shared setting.
+- It is a question of *when*, not of *whether*: an agent an admin has switched off stays off for everybody, whatever any individual interval says.
+
+The other three agents have no per-person version of this. The lints read a store only its owner edits, and the review is pinned to an hour of the night — neither has a cadence that depends on the person.