feat(automation): add Pydantic schemas for the automation definition

Three layers of Pydantic models under app/automations/schemas/, one
file per concern (SRP), matching the envelope in
automation-design-plan.md §5.

definition/ — the editable envelope persisted in
automations.definition:
  - envelope.py       AutomationDefinition (top-level shape)
  - plan_step.py      PlanStep (one step in the sequential plan)
  - inputs.py         InputsBlock (the inputs JSON Schema wrapper)
  - execution.py      ExecutionBlock (timeouts, retries, concurrency,
                                      budget cap, on_failure plan)
  - metadata.py       MetadataBlock (tags + created_from_nl + extras)
  - trigger_spec.py   TriggerSpec (one entry in triggers[])

triggers/ — per-trigger config schemas, dispatched by registry on the
TriggerSpec.type discriminator:
  - schedule.py       ScheduleTriggerConfig(cron, timezone)
  - manual.py         ManualTriggerConfig() — empty in v1

actions/ — per-action config schemas, dispatched by registry on the
PlanStep.action discriminator:
  - agent_task.py     AgentTaskActionConfig(prompt, tools, model,
                                            output_schema)

Design properties verified by an inline smoke test:
  - The §5 worked example round-trips through model_validate_json /
    model_dump_json byte-for-byte (InputsBlock uses
    serialize_by_alias so the JSON key stays "schema" not
    "schema_").
  - Envelope rejects unknown top-level keys (extra="forbid").
  - MetadataBlock tolerates unknown keys (extra="allow").
  - ExecutionBlock defaults apply when the block is omitted.
  - retry_backoff and concurrency are typed as Literal — bogus
    values rejected at validation time.
  - Per-type configs enforce their required fields (cron + timezone
    on schedule; non-empty prompt on agent_task).

The envelope keeps trigger and action configs as untyped dicts on
purpose — per-type validation is a registry-driven dispatch (commit
10), keeping the envelope free of every-type-knows-every-type
coupling.

surfsense_backend/app/automations/schemas/definition/inputs.py

@@ -0,0 +1,43 @@
+"""``InputsBlock`` — the ``inputs`` section of the automation definition."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class InputsBlock(BaseModel):
+    """The ``inputs`` block of an ``AutomationDefinition``.
+
+    Holds a JSON Schema describing what data the automation accepts at
+    fire time. The same schema is used by:
+
+    - The form editor (to render the manual-run dialog).
+    - The dispatcher (to validate trigger payloads before enqueueing
+      executor work).
+    - The template engine (to expose ``{{ inputs.* }}`` references in
+      plan-step configs).
+
+    The ``schema`` value is the JSON-Schema dict itself, not a
+    Pydantic model — automations express their input contract in pure
+    JSON Schema so it round-trips losslessly through the database and
+    the NL generator.
+    """
+
+    model_config = ConfigDict(
+        extra="forbid",
+        populate_by_name=True,
+        serialize_by_alias=True,
+    )
+
+    schema_: dict[str, Any] = Field(
+        ...,
+        alias="schema",
+        description=(
+            "JSON Schema (draft-07 compatible) describing the inputs "
+            "this automation accepts. Properties may use the special "
+            "``$last_fired_at`` default literal to bind to the "
+            "trigger's last fire time."
+        ),
+    )