Document the internal GC endpoint and Cloud Scheduler setup

[acoshift]

Summary

• Document POST /internal/gc in the README: what it deletes (files where expires_at < now() from both GCS and Postgres), its 204 response, that it's safe to re-run, and that nothing runs it on a timer inside the service.
• Add internal_secret to the environment variable table — the bearer token guarding the endpoint (unauthenticated when unset).
• Add a "Garbage collection" section with a gcloud scheduler jobs create http example that runs GC hourly, plus notes on --uri reachability (the route shares the public host, so it may only be reachable in-cluster depending on ingress), keeping --headers in sync with internal_secret on rotation, and a gcloud scheduler jobs run command to verify.

Docs-only change; no code touched.

🤖 Generated with Claude Code