fix(saas): P2 code quality fixes + config PATCH/PUT alignment

P2 code quality (SEC2-P2-01~10):
- P2-04: Replace vague TODO with detailed Phase 2 design note in generate_embedding.rs
- P2-05: Add NOTE(fire-and-forget) annotations to 4 long-running tokio::spawn in main.rs
- P2-07: Add DESIGN NOTE to scheduler explaining sequential execution rationale
- P2-08: Add compile-time table name whitelist + runtime char validation in db.rs
- P2-02: Verified N/A (only zclaw-pipeline uses serde_yaml_bw, no inconsistency)
- P2-06: Verified N/A (bind loop correctly matches 6-column placeholders)
- P2-03: Remains OPEN (requires upstream sqlx release)

Config HTTP method alignment (B3-4):
- Fix admin-v2 config.ts: request.patch -> request.put to match backend .put() route
- Fix backend handler doc comment: PATCH -> PUT
- Add @reserved annotations to 6 config handlers without frontend callers

crates/zclaw-kernel/src/scheduler.rs

@@ -115,6 +115,13 @@ impl SchedulerService {
         }; // Lock dropped here
 
         // Execute due triggers (acquire lock per execution)
+        // DESIGN NOTE: Triggers execute sequentially within each check cycle. This is intentional:
+        // 1. Prevents concurrent hand runs from competing for shared resources
+        // 2. Maintains deterministic ordering for trigger execution
+        // 3. A long-running hand will delay subsequent triggers in the same cycle
+        //    but will NOT skip them — they are processed on the next tick.
+        // If parallel execution is needed, spawn each execute_hand in a separate task
+        // and collect results via JoinSet.
         let now = chrono::Utc::now();
         for (trigger_id, hand_id, cron_expr) in to_execute {
             tracing::info!(