fix(patching): final review fixes

- no dispatch in the last 15 minutes of a window; no-result timeout from dispatch time
- per-server output moves to patch_run_outputs (16MB document limit)
- reboot proven by a changed boot time; RebootTimeout 45m, ResultGrace 20m
- window update and delete are server-scoped against the policies using them
- scheduler puts the claim back on an error after it, so the next tick retries
- cancelled runs with failures alert; MCP apply_updates audits per server
- apply-updates 503 body documented; openapi regenerated
- web: cleared numeric fields no longer save as 0; Run now asks for confirmation

server/internal/models/patch.go

@@ -105,8 +105,12 @@ type PatchServerRun struct {
 	PendingAfter  *int       `bson:"pending_after,omitempty" json:"pending_after,omitempty"`
 	RebootedAt    *time.Time `bson:"rebooted_at,omitempty" json:"rebooted_at,omitempty"`
 	VerifiedAt    *time.Time `bson:"verified_at,omitempty" json:"verified_at,omitempty"`
-	Output        string     `bson:"output,omitempty" json:"output,omitempty"`
-	Error         string     `bson:"error,omitempty" json:"error,omitempty"`
-	StartedAt     *time.Time `bson:"started_at,omitempty" json:"started_at,omitempty"`
-	FinishedAt    *time.Time `bson:"finished_at,omitempty" json:"finished_at,omitempty"`
+	// BootTimeBefore is the host's reported boot time when the reboot was
+	// announced. A later report with a different boot time proves the
+	// restart without comparing the host clock to the server clock.
+	BootTimeBefore *time.Time `bson:"boot_time_before,omitempty" json:"-"`
+	Output         string     `bson:"output,omitempty" json:"output,omitempty"`
+	Error          string     `bson:"error,omitempty" json:"error,omitempty"`
+	StartedAt      *time.Time `bson:"started_at,omitempty" json:"started_at,omitempty"`
+	FinishedAt     *time.Time `bson:"finished_at,omitempty" json:"finished_at,omitempty"`
 }

server/internal/models/server.go

@@ -42,6 +42,9 @@ type Inventory struct {
 	RebootRequired bool        `bson:"reboot_required,omitempty" json:"reboot_required,omitempty"`
 	MetricsAt      *time.Time  `bson:"metrics_at,omitempty" json:"metrics_at,omitempty"`
 	StaticAt       *time.Time  `bson:"static_at,omitempty" json:"static_at,omitempty"`
+	// BootTime is the host's last reported boot time, stored on every report
+	// that carries one so a patch reboot can be proven by a changed boot.
+	BootTime *time.Time `bson:"boot_time,omitempty" json:"boot_time,omitempty"`
 }
 
 type Server struct {