M5: Patch Deployment & Job Management

Backend:
- migrations/003_jobs_scheduling.sql: retry_next_at/last_error columns,
  pg_notify trigger for immediate job dispatch, retry index
- pm-agent-client: ApplyPatchesRequest/Response, AgentJobStatus,
  RollbackResponse types; apply_patches/job_status/rollback_job
  client methods + generic POST helper
- pm-core/models: JobStatus, JobKind, PatchJob, PatchJobHost,
  CreateJobRequest, PatchJobSummary
- pm-web/routes/jobs.rs: POST/GET /api/v1/jobs, GET /jobs/:id,
  POST /jobs/:id/cancel, POST /jobs/:id/rollback
- pm-worker/job_executor.rs: NOTIFY listener, periodic scanner,
  execute_host_job, poll_running_jobs, handle_host_failure (3-retry
  exponential backoff 1m/5m/30m), sync_job_status, retry_pending_jobs
- pm-worker/main.rs: spawn job_executor

Frontend:
- types/index.ts: PatchInfo, PatchJobHost, PatchJob, PatchJobSummary,
  CreateJobRequest interfaces
- api/client.ts: jobsApi (list/get/create/cancel/rollback),
  patchesApi (getHostPatches)
- pages/PatchDeploymentPage.tsx: 3-step MUI Stepper
  (host select → configure → result)
- pages/JobsPage.tsx: job list table, expandable per-host detail,
  cancel/rollback actions with confirm dialog, load-more pagination
- App.tsx: /jobs and /deployment routes wired to real pages

cargo check: 0 errors | vite build: 0 errors

crates/pm-worker/src/agent_loader.rs

@@ -0,0 +1,45 @@
+//! Helper for loading mTLS certificate/key material from disk.
+//!
+//! Reads PEM files referenced in [`SecurityConfig`] and returns the raw bytes
+//! needed by [`pm_agent_client::AgentClient`].
+
+use pm_core::config::SecurityConfig;
+
+/// Raw PEM bytes for mTLS client authentication and CA verification.
+pub struct AgentCerts {
+    pub client_cert: Vec<u8>,
+    pub client_key: Vec<u8>,
+    pub ca_cert: Vec<u8>,
+}
+
+/// Load agent mTLS certificates from the paths specified in [`SecurityConfig`].
+///
+/// Returns an error if any file cannot be read. The caller should handle
+/// the error gracefully (log and skip the poll cycle) rather than crashing.
+pub fn load_agent_certs(security: &SecurityConfig) -> anyhow::Result<AgentCerts> {
+    let client_cert = std::fs::read(&security.agent_client_cert_path).map_err(|e| {
+        anyhow::anyhow!(
+            "Failed to read agent client cert '{}': {}",
+            security.agent_client_cert_path,
+            e
+        )
+    })?;
+
+    let client_key = std::fs::read(&security.agent_client_key_path).map_err(|e| {
+        anyhow::anyhow!(
+            "Failed to read agent client key '{}': {}",
+            security.agent_client_key_path,
+            e
+        )
+    })?;
+
+    let ca_cert = std::fs::read(&security.ca_cert_path).map_err(|e| {
+        anyhow::anyhow!(
+            "Failed to read CA cert '{}': {}",
+            security.ca_cert_path,
+            e
+        )
+    })?;
+
+    Ok(AgentCerts { client_cert, client_key, ca_cert })
+}