A fix-focused release. Knocks down a cluster of install-time crashes, makes the backup schedule configurable, surfaces the full ServerShutdown broadcast in the admin UI, and adds a guarded cleanup for accumulated database-operation pods.

## Reinstall step

After updating the desktop app, click **Install / Update** on the Management Service card so the refreshed on-host service binary is pushed. If you previously workaround-started the service with `sudo ./dune-server-service &`, kill that process first so the new systemd / OpenRC unit owns the only running copy.

## Fixed

- **Management service silently failed to start on install** (issues #5, #6). The install flow now pre-creates every directory the systemd / OpenRC unit references (`~/.dune`, `~/.dune/state`, `~/.local`, `~/.steam`, `~/Steam`) with `dune:dune` ownership, plus the supervisor log file. Previously the unit started, immediately tripped on mount-namespace setup, and exited with `status=226/NAMESPACE` only visible in `journalctl`.
- **Service now always runs as the `dune` user**, regardless of which account you SSH in as (issue #3). The installer no longer rewrites the systemd unit with the SSH user's home; it pins `User=dune Group=dune` and paths under `/home/dune`. Operators logging in as `root` or `ubuntu` no longer get a unit pointing at `/root/.steam` that fails to mount.
- **Battlegroup start / stop / restart / update use the registered SSH user for vendor-wrapper impersonation** instead of hardcoding `dune`. Fixes a half-broken state from v0.3.6 where status reads worked but lifecycle actions silently misbehaved.
- **Manual ServerShutdown broadcast no longer no-ops.** Previously sent an empty payload that the game discarded; now sends the full countdown shape with `ShutdownType`, `ShutdownTimestamp`, `BroadcastFrequency`, and `BroadcastDuration`.
- **OpenRC unit self-heals on every start.** `start_pre` now also creates the parent `.dune` directory and the supervisor log file via `checkpath`.
- **Install verify step shows why the service is not active** by tailing `journalctl` (systemd) or the supervisor log (OpenRC). No more empty-parenthesis "not active ()" message.

## Added

- **Configurable backup schedule via 5-field cron expression**, with live validation and a preview of the next 5 fire times in your configured timezone. Default is disabled — vendor backups block server I/O for the full dump, so the manager no longer schedules them automatically. Set your own cadence under Management -> Automated Tasks -> Configure.
- **Full ServerShutdown broadcast surface in Admin -> Broadcast**: ShutdownType selector (Restart / Maintenance / Update), lead time, repeat frequency, display duration, and a "Cancel pending shutdown" toggle that short-circuits the payload (per the protocol parser). The scheduled `restart-notice` task ships the same shape so manual and automatic flows are now consistent.
- **"Clean up database operations" button** on Management -> Automated Tasks. Lists every terminal `DatabaseOperation` CR (Succeeded or Failed, dump or import) with phase badges, lets you tick which to delete, then deletes them via `kubectl delete databaseoperation`. The `.backup` files on disk are never touched, in-progress operations are never listed, and the server re-validates every item server-side before deleting.
- **Static musl service binary** ships in every release, so the daemon runs on Alpine images without a glibc loader.

## Changed

- The `publish_server_shutdown` helper that backs the scheduled restart-notice broadcast now emits `BroadcastDuration` so its payload matches the manual Admin form and the protocol spec.
- The on-install account discovery no longer follows the SSH login user — it resolves the canonical `dune` user via `getent passwd dune` and errors loudly if the vendor setup has not provisioned that account yet.
- Bundled systemd unit marks `/funcom/artifacts/database-dumps` as optional (`-` prefix on `ReadWritePaths`), so a fresh host without k3s + vendor setup no longer namespace-faults on first start.