docker: alpine base with openssh-client, mount SSH key + NET_RAW for scheduler

- Switch Dockerfile from distroless/static to alpine:3.21
- Install openssh-client-default in runtime image
- Mount SSH key in scheduler service (docker-compose)
- Add NET_RAW capability for ping checks
- Wire OIKOS_SSH_KEY_PATH and OIKOS_SSH_USER env vars in scheduler
- sshExec uses configured key path with StrictHostKeyChecking=no

compose/oikos/Dockerfile

@@ -23,8 +23,10 @@ COPY --from=ui-builder /web/dist ./web/dist
 
 RUN CGO_ENABLED=0 go build -o /oikos -tags timetzdata -ldflags="-s -w" ./cmd/oikos
 
-# --- Runtime: distroless static ---
-FROM gcr.io/distroless/static:nonroot
+# --- Runtime: alpine with SSH + ping for scheduler checks ---
+FROM alpine:3.21
+
+RUN apk add --no-cache ca-certificates openssh-client-default
 
 COPY --from=builder /oikos /oikos
 COPY --from=builder /build/seeds /seeds