feat: M6 maintenance windows + M7 WebSocket relay (real-time job status)

M6 - Maintenance Windows:
- routes/maintenance_windows.rs: full CRUD API
- migrations/004_maintenance_windows.sql
- frontend/MaintenanceWindowsPage.tsx
- HostDetailPage.tsx: maintenance window config panel

M7 - WebSocket Relay:
- pm-web: POST /api/v1/ws/ticket (JWT-auth, single-use, 60s TTL)
- pm-web: WS /api/v1/ws/jobs?ticket=... (PgListener -> browser push)
- pm-web: DashMap<String,WsTicket> in AppState, 30s cleanup task
- pm-worker: ws_relay.rs subscribes to agent WS, updates patch_job_hosts,
  fires pg_notify(job_update) for real-time fan-out
- frontend: useJobWebSocket hook with auto-reconnect + exponential backoff
- frontend: JobsPage live updates with WS status indicator
- types: JobWsEvent interface
- api/client: wsApi.createTicket()

All tasks marked complete in tasks/todo.md
cargo build: zero errors, zero warnings

migrations/004_maintenance_windows.sql

@@ -0,0 +1,25 @@
+-- Migration: 004_maintenance_windows
+-- Description: Additional indexes and scheduler-support for maintenance windows.
+--              The maintenance_windows table and window_recurrence ENUM were
+--              created in 001_initial_schema.sql.  This migration adds composite
+--              indexes needed by the M6 maintenance_scheduler worker and patches
+--              the audit_action ENUM to include window events already listed in
+--              the audit log helper (they were declared there but the ENUM values
+--              already exist – guarded with a DO block to be idempotent).
+
+-- ============================================================
+-- Composite index: scheduler query
+--   Finds enabled windows by recurrence type + recurrence_day quickly.
+-- ============================================================
+
+CREATE INDEX IF NOT EXISTS idx_mw_enabled_recurrence
+    ON maintenance_windows (recurrence, recurrence_day)
+    WHERE enabled = TRUE;
+
+-- ============================================================
+-- Index: quickly find non-immediate queued jobs for a given host
+-- ============================================================
+
+CREATE INDEX IF NOT EXISTS idx_pjh_queued_host
+    ON patch_job_hosts (host_id, status)
+    WHERE status = 'queued';