Add Vercel Cron Jobs for daily reminders and DB cleanup #3710

Originally written by @Copilot on GitHub.
Imported from https://github.com/ccantynz-alt/Hibiscus-to-airport/pull/37

The repo had migrated from APScheduler to Vercel Cron Jobs but only one cron (/api/cron/reminders) was wired up. Expired password reset tokens were never cleaned from the DB, and the full scheduled-task picture wasn't clear.

Changes

• api/cron/cleanup.js (new) — Deletes password_resets rows where expires_at is older than 2 hours (tokens are valid for 1h; the 2h window avoids any race). Mirrors the auth pattern from reminders.js (CRON_SECRET bearer check, standard { ok, results } response).
• vercel.json — Registers /api/cron/cleanup at 0 6 * * * (6AM UTC = 7PM NZDT), one hour after the reminders job.

Scheduled tasks now active

Both jobs require CRON_SECRET to be set as a Vercel environment variable; Vercel injects it automatically as `Authorization: ****** on each invocation.