feat: select the jobs file itself in Settings

The Jobs directory row named a folder and assumed the file inside it was
called jobs.json. It is now a Jobs file row: Browse opens a file picker
filtered to .json, the field stays editable so a file that does not exist yet
can be typed, and the job list can live under any name.

Config.JobsDir/jobs_dir becomes Config.JobsFile/jobs_file, holding the whole
path; Paths.JobsDir is derived from it so saves still create the folder. An
older gosentry.json is migrated on load by joining its jobs_dir with
jobs.json — the exact file that version used — and the retired key is dropped
when the config is rewritten. The default clears before unmarshalling, or a
file that omits jobs_file and a file that sets it would be indistinguishable
and the migration would never run.

Saving used to write the current job list over whatever was at the new path,
which made switching to an existing jobs file impossible: its contents were
destroyed. An existing file now wins. Its jobs are loaded, normalized, and
adopted, with runtimes, schedule cache, next-run times and log-seeded
statistics rebuilt around them by adoptJobsLocked — the same helper NewService
now uses, so construction and adoption cannot drift. A path with no file
behind it still receives the current jobs, which is how the file is renamed or
relocated. The new file is read before anything is written, so an unparsable
one leaves both the config and the jobs untouched.

Adoption drops every runtime, and a run finishing afterwards would write its
result onto whichever job inherited its ID, so the switch is refused while a
job is running. Unrelated settings still save during a run. Because the
replacement happens without a prompt, the Service emits JobsLoaded with the
path and count, and History carries the receipt.

A path that names only a folder (trailing separator, a dot, or two dots) is
rejected with a validation error instead of failing later with an opaque OS
error.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -63,7 +63,7 @@ portable application: moving the program folder also moves its configuration.
 
 ```json
 {
-  "jobs_dir": ".",
+  "jobs_file": "jobs.json",
   "logs_dir": "logs",
   "max_log_files": 100,
   "max_log_age_days": 30,
@@ -91,10 +91,15 @@ portable application: moving the program folder also moves its configuration.
 }
 ```
 
-`jobs_dir` is the directory GoSentry reads `jobs.json` from. The default `"."`
-means the same folder as the executable. An absolute path can be used when jobs
+`jobs_file` is the file GoSentry reads job definitions from, file name included,
+so the file can be named anything. The default `"jobs.json"` is relative and
+resolves to the executable's folder. An absolute path can be used when jobs
 should live elsewhere, such as a shared network drive.
 
+A `gosentry.json` from an earlier version that carries `jobs_dir` instead keeps
+working: the directory is combined with `jobs.json` on load, and the file is
+rewritten with `jobs_file`.
+
 `logs_dir` is relative to the program folder when it does not start with a
 drive letter or `/`.
 
@@ -132,9 +137,20 @@ Standard 5-field cron expressions:
 5. Use **Pause** on a single job to suspend it without deleting it.
 6. Use **Pause all** as a global stop switch for all scheduled runs.
 7. Open **History** to see past runs, their trigger (`Manual`, `Schedule`, or `UI`), state, and log file.
-8. Open **Settings** to change storage directories, log cleanup limits, queue behavior, and notifications.
+8. Open **Settings** to change the storage paths, log cleanup limits, queue behavior, and notifications.
 
-Changing `jobs_dir` in Settings saves the current job list to the new directory.
+The **Jobs file** row picks the file itself: **Browse** lists `.json` files, and
+a path can also be typed to name a file that does not exist yet. What Save does
+depends on whether that file is already there:
+
+- **The file exists** — its jobs are loaded and replace the current list, so
+  selecting a jobs file switches to it (another machine's file, a shared one on
+  a network drive). History records how many jobs were loaded and from where.
+- **The file does not exist** — the current jobs are written to it, which is how
+  the jobs file is renamed or moved somewhere else.
+
+Switching to a different jobs file is refused while a job is running, because
+loading a new list discards the run state of the old one.
 
 The **Start on login** checkbox shows an `OK` or `Problem` status. Saving with
 it enabled writes an autostart entry using the current executable path.