T3.1: Add app.Service owning state behind a mutex

Create src/app/service.go: the application-service layer that becomes
the single owner of the durable jobs slice and the transient runtime
map, guarded by a non-reentrant sync.Mutex. NewService wires a loaded
store; Open() is the convenience entry point. Read-only accessors
(Jobs/Runtime/Store) take the lock, and Jobs() returns a copy to keep
callers from mutating Service-owned state.

State-mutating intents and the event/observer machinery are deferred to
T3.2-T3.4. Adds no-Fyne unit tests for runtime construction, copy
isolation, and store wiring.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/REFACTORING.md

@@ -260,7 +260,7 @@ Track progress here. Mark tasks complete as they land and pass review.
 - [x] T2.4 — Update `storage`: load/save Job only; move runtime init _(landed with T2.3)_
 
 ### Phase 3 — Application service layer
-- [ ] T3.1 — Create `src/app/service.go`; owns state behind mutex
+- [x] T3.1 — Create `src/app/service.go`; owns state behind mutex
 - [ ] T3.2 — Add `src/app/events.go`; Event types + Observer
 - [ ] T3.3 — Add state-mutating operations to service
 - [ ] T3.4 — Convert `scheduler` to use service; inject Clock