feat(web): add configurable cron command execution settings

[wj-xiao]

📝 Description

This PR makes cron command execution configurable from both the backend config and the web config UI.

• add tools.cron.allow_command with a default value of true to preserve existing behavior
• require command_confirm=true only when cron command execution is explicitly disabled
• expose cron shell execution permission and timeout settings in the config page
• add config and cron tool tests for the new behavior

🗣️ Type of Change

• 🐞 Bug fix (non-breaking change which fixes an issue)
• ✨ New feature (non-breaking change which adds functionality)
• 📖 Documentation update
• ⚡ Code refactoring (no functional changes, no api changes)

🤖 AI Code Generation

• 🤖 Fully AI-generated (100% AI, 0% Human)
• 🛠️ Mostly AI-generated (AI draft, Human verified/modified)
• 👨‍💻 Mostly Human-written (Human lead, AI assisted or none)

🔗 Related Issue

N/A

📚 Technical Context (Skip for Docs)

• Reference URL: N/A
• Reasoning: Cron command scheduling is already restricted to internal channels. This change adds an explicit config gate for scheduled shell commands, keeps the default backward-compatible, and exposes the related controls in the web UI so operators can disable command scheduling without changing code.

🧪 Test Environment

• Hardware: Apple Silicon Mac / local development machine
• OS: macOS
• Model/Provider: N/A (config and tool behavior verified with automated tests)
• Channels: CLI / internal channel test cases

📸 Evidence (Optional)

Click to view Logs/Screenshots

make check

☑️ Checklist

• My code/docs follow the style of this project.
• I have performed a self-review of my own changes.
• I have updated the documentation accordingly.