fix(workbook): avoid duplicate recurring refresh chains on policy save

[rudycelekli]

What changed

Saving an enabled workbook refresh policy now keeps an existing pending or processing refresh_workbook job instead of starting another recurring chain. The policy still persists normally; completed history does not prevent a new schedule, and disabled policies do not enqueue a new job.

The existing worker continuation is unchanged. This preserves sequential saves, including when the existing owner is already due or claimed. It does not provide atomic deduplication for simultaneous requests, repair previously duplicated jobs, or reset the current scheduled deadline when the interval changes.

Reproduction and verification

The seven frozen regression cases use the real FastAPI PUT /refresh-policy route, real SQLAlchemy models and owned SQLite databases, with an authorized fixture user. Four cases fail against 48aacfd44946bcf20201b58d989c0fe07cc40c09: repeated save, future pending owner, overdue pending owner and processing owner. The three policy persistence/disable/history controls pass. The same unchanged tests pass 7/7 after this change.

• Focused refresh/queue ownership, claims, lease recovery and failure reconciliation: 30 passed.
• Broad offline backend attempt: 2098 passed, 134 skipped, 3 deselected, 1 failed. The failure is tests/test_queue_load.py::test_load_harness_measures_invariants_and_cleans_up, where its SQLite tenant-cap measurement observed 3 active jobs for a cap of 2. This is retained as a failed check; it is not presented as green or attributed to a proven root cause. Accepted-main isolated comparisons passed 5/5; the accepted-main broad comparison was inconclusive: 2046 passed, 134 skipped, 3 deselected, 2 failed and 79 errors after disk exhaustion prevented temp-fixture setup/teardown; its bounded runner then timed out. This does not establish the load-harness failure is inherited.
• git diff --check and changed Python compilation pass.

Tests ran in an isolated Python 3.13 environment that reuses system packages and adds missing real dependencies locally. Key actual versions: FastAPI 0.115.14, SQLAlchemy 2.0.36, pytest 9.0.2, HTTPX 0.28.1 and Alembic 1.16.5. It is not equivalent to uv run --frozen; no network providers or production databases were exercised. The unchanged repository four-job workflow subsequently passed on this exact signed head with fresh frozen dependencies: fork qualification37942526734. Backend SQLite: 2099 passed, 134 skipped, 3 deselected; PostgreSQL integrity/tenancy: 18 passed; mounted browser regressions: 3 passed. Frontend lint/tests/build also pass. All four jobs succeeded on signed 28f3339d31c77451cf9d3d0bbace845f05e70c46. That canonical hosted success is separate from the retained local broader failure and inconclusive baseline; no root-cause attribution is inferred. Upstream PR checks will run separately after creation.

AI-assisted implementation and testing, reviewed against the current contribution and security policies.