fix(scheduler): skip discovery for users with no video connection

The scheduler enumerates every user_identities row (ListAllUsers) and ran a
discovery pass for each — including users who never connected a video source.
Their per-user runner then tried to resolve a YouTube refresh token that was
never minted, logging a spurious "secrets: ref not found:
youtube/<uid>/refresh_token" every tick (e.g. stale Dex-era orphan identities
left by the Authentik migration).

Skip users whose ConnectionsForUser is empty before running their pass. Removes
the recurring noise — which actively misled a debug session into thinking a
healthy onboarded user was broken — with no change to connected users.

Refs #7

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

cmd/tapir/scheduler_test.go

@@ -21,14 +21,25 @@ func quietLog() *slog.Logger {
 
 // fakeLister returns a fixed user set (or an error) for the scheduler under test.
 type fakeLister struct {
-	users []store.UserIdentity
-	err   error
+	users  []store.UserIdentity
+	err    error
+	noConn map[string]bool // users that have NOT connected a video source
 }
 
 func (f fakeLister) ListAllUsers(context.Context) ([]store.UserIdentity, error) {
 	return f.users, f.err
 }
 
+// ConnectionsForUser reports a single youtube connection for every user except
+// those in noConn, which return zero — the connection-less case the scheduler
+// must skip instead of running (and failing to resolve a token for).
+func (f fakeLister) ConnectionsForUser(_ context.Context, userID string) ([]store.Connection, error) {
+	if f.noConn[userID] {
+		return nil, nil
+	}
+	return []store.Connection{{Provider: "youtube"}}, nil
+}
+
 // countingRunUser records how many passes each user got, optionally failing for
 // specific users, under a mutex so it is safe across the scheduler goroutine.
 type countingRunUser struct {
@@ -91,6 +102,21 @@ func TestDiscoveryPassRunsEveryUserOnce(t *testing.T) {
 	require.Equal(t, 3, stats.Summarized, "stats are summed across users")
 }
 
+func TestDiscoveryPassSkipsUsersWithoutConnections(t *testing.T) {
+	// b never connected a video source (e.g. a stale Dex-era orphan identity).
+	// It must be skipped silently — not run and logged as a token error every pass.
+	lister := fakeLister{users: usersN("a", "b", "c"), noConn: map[string]bool{"b": true}}
+	rc := newCountingRunUser()
+
+	stats := runDiscoveryPass(context.Background(), lister, rc.run, quietLog())
+
+	require.Equal(t, 1, rc.count("a"))
+	require.Equal(t, 0, rc.count("b"), "a user with no connection must be skipped, not run")
+	require.Equal(t, 1, rc.count("c"))
+	require.Equal(t, 2, stats.Summarized, "only connected users contribute")
+	require.Equal(t, 0, stats.Errors, "skipping is silent — no spurious error stat")
+}
+
 func TestDiscoveryPassOneUserFailureDoesNotStopOthers(t *testing.T) {
 	lister := fakeLister{users: usersN("a", "b", "c")}
 	rc := newCountingRunUser("b") // user b's pass errors