Stage 5: on-call schedule

- Migration 005: schedule_entries table (date TEXT UNIQUE, one person per day)
- POST /api/schedule — assign user to one or more dates in a single
  transaction; any date conflict rejects the whole request (409)
- GET /api/schedule — list all entries ordered by date, optional ?from/?to
- GET /api/schedule/current — today's on-call user (UTC date), 404 if none
- DELETE /api/schedule/{id} — remove an entry (204)

internal/api/router.go

@@ -38,6 +38,11 @@ func NewRouter(db *sql.DB) http.Handler {
 		r.Get("/api/alerts/{id}/comments", handleListComments(db))
 		r.Post("/api/alerts/{id}/comments", handleCreateComment(db))
 		r.Delete("/api/alerts/{id}/comments/{commentID}", handleDeleteComment(db))
+
+		r.Post("/api/schedule", handleCreateSchedule(db))
+		r.Get("/api/schedule/current", handleCurrentSchedule(db)) // must be before /{id}
+		r.Get("/api/schedule", handleListSchedule(db))
+		r.Delete("/api/schedule/{id}", handleDeleteSchedule(db))
 	})
 
 	return r