fix(patching): final review fixes

- no dispatch in the last 15 minutes of a window; no-result timeout from dispatch time
- per-server output moves to patch_run_outputs (16MB document limit)
- reboot proven by a changed boot time; RebootTimeout 45m, ResultGrace 20m
- window update and delete are server-scoped against the policies using them
- scheduler puts the claim back on an error after it, so the next tick retries
- cancelled runs with failures alert; MCP apply_updates audits per server
- apply-updates 503 body documented; openapi regenerated
- web: cleared numeric fields no longer save as 0; Run now asks for confirmation

server/internal/mcp/tools_write.go

@@ -162,12 +162,11 @@ type updateBatchResult struct {
 
 // apply_updates. The REST route (internal/api/handlers.go's applyUpdates) is
 // per-server: POST /servers/:id/apply-updates resolves one server with
-// services.GetServerScoped and calls services.DispatchApplyUpdates(serverID).
-// There is no fleet-wide variant of that service call to invoke once, so this
-// tool resolves the requested targets through ResolveTargetsScoped exactly as
-// the brief describes, then calls the same DispatchApplyUpdates the REST route
-// calls, once per resolved server - the identical dispatch, just looped
-// instead of hardcoded to one server_id from the URL.
+// services.GetServerScoped and calls services.StartManualRun. There is no
+// fleet-wide variant of that service call to invoke once, so this tool
+// resolves the requested targets through ResolveTargetsScoped, then calls the
+// same StartManualRun once per resolved server and writes the same
+// updates.applied audit event per server with its run ID.
 func init() {
 	All().Register(Tool{
 		Name: "apply_updates",
@@ -201,6 +200,8 @@ func init() {
 					result.Failed[srv.ServerID] = err.Error()
 					continue
 				}
+				services.LogEvent(c.InstanceID, "updates.applied", "mcp:"+c.TokenName, srv.ServerID, "",
+					fmt.Sprintf("package update run %s started on %s", run.RunID, srv.Hostname))
 				result.Succeeded = append(result.Succeeded, srv.ServerID)
 				if result.RunIDs == nil {
 					result.RunIDs = map[string]string{}