When auto-sync is enabled but credentials (LoTW/DCL) are removed, the
scheduler would continuously try to sync every minute, logging the same
warning forever.
Now:
- Split pending users into those with and without credentials
- For users without credentials, update nextSyncAt to retry in 24 hours
- Log a warning with affected user IDs
- Only return users with valid credentials for job processing
This prevents log spam and unnecessary database queries while still
periodically checking if credentials have been restored.
Co-Authored-By: Claude <noreply@anthropic.com>