fix: resolve maintenance windows race condition and N+1 query

- Add GET /api/v1/maintenance-windows bulk endpoint to eliminate N+1
  per-host API calls (1 request instead of N+1)
- Fix two-phase state update race: setHosts() was called before
  setWindowsByHost(), causing React to render hosts with empty windows
- Add AbortController to cancel stale fetch requests on unmount/re-fetch
- Batch state updates atomically (React 18 auto-batching)
- Replace silent catch{} with proper error handling
- Add refreshData() wrapper for mutation handlers and Refresh button

Backend: maintenance_windows.rs - new list_all_windows handler +
all_windows_router(), mounted in main.rs
Frontend: client.ts - new listAll() API method
Frontend: MaintenanceWindowsPage.tsx - rewritten fetchData

crates/pm-web/src/routes/maintenance_windows.rs

@@ -1,6 +1,7 @@
 //! Maintenance window management routes.
 //!
 //! GET    /api/v1/hosts/{id}/maintenance-windows           — list windows for host
+//! GET    /api/v1/maintenance-windows                     — list ALL windows (bulk)
 //! POST   /api/v1/hosts/{id}/maintenance-windows           — create window for host
 //! PUT    /api/v1/hosts/{id}/maintenance-windows/{win_id}  — update window
 //! DELETE /api/v1/hosts/{id}/maintenance-windows/{win_id}  — delete window
@@ -32,6 +33,41 @@ pub fn router() -> Router<AppState> {
         .route("/{win_id}", put(update_window).delete(delete_window))
 }
 
+/// Top-level router for `/api/v1/maintenance-windows` — bulk list-all endpoint.
+pub fn all_windows_router() -> Router<AppState> {
+    Router::new().route("/", get(list_all_windows))
+}
+
+// ── GET /api/v1/maintenance-windows ──────────────────────────────────────────
+
+/// Bulk endpoint: return every maintenance window across all hosts.
+/// Eliminates N+1 queries from the frontend (one request instead of one per host).
+async fn list_all_windows(
+    State(state): State<AppState>,
+    _auth: AuthUser,
+) -> Result<Json<Value>, (StatusCode, Json<Value>)> {
+    let windows: Vec<MaintenanceWindow> = sqlx::query_as(
+        r#"
+        SELECT id, host_id, label, recurrence, start_at, duration_minutes,
+               recurrence_day, enabled, auto_apply, created_at, updated_at
+        FROM   maintenance_windows
+        ORDER  BY host_id, created_at ASC
+        "#,
+    )
+    .fetch_all(&state.db)
+    .await
+    .map_err(|e| {
+        tracing::error!(error = %e, "list_all_windows: query failed");
+        err(
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "internal_error",
+            "Database error",
+        )
+    })?;
+
+    Ok(Json(json!({ "windows": windows })))
+}
+
 // ── Error helper ──────────────────────────────────────────────────────────────
 
 #[inline]