v0.168.0: customer-configurable backup window (Mentési időablak)

ONE setting (window start W) drives every nightly leg at fixed, never-stored
offsets: DB dump at W, tier-2 at W+60m, off-box at W+105m (wrap-safe). Precedence
settings > controller.yaml db_dump_schedule > 02:30.

- scheduler.UpdateDaily: retime a daily job at runtime (no restart) via a per-job
  buffered resched chan + a select case in runDailyJob.
- new pure package internal/backupwindow (LegTimes/GateWindow/EffectiveWindow).
- quiesce disk-tier window gate: scheduled cycles run only inside [W+2h,W+6h) with a
  safety valve (age>cadence+24h runs regardless); manual TriggerNow never gated.
  Backend.Due now also returns the backup age (from the agent's own /backup/due).
- backup page: Mentési időablak card (time input + derived leg/gate rows); POST
  /backups/window validates -> saves -> UpdateDaily x3 -> flash.

Tests: 5 groups, all red-proofed. Agent/cadence//backup/due untouched.

CONTEXT.md

@@ -7,7 +7,25 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-07-24 (v0.167.0 — outlined logo + favicon, the v0.166.0 Part-4 follow-up)
+Last updated: 2026-07-24 (v0.168.0 — customer-configurable backup window "Mentési időablak")
+
+> **2026-07-24 — v0.168.0 (customer-configurable backup window).** ONE customer setting — the window
+> start W ("Mentési időablak kezdete") — drives every nightly leg at FIXED, never-stored offsets so
+> misordering is impossible: DB dump at W, tier-2 at W+60m, off-box at W+105m (wrap-safe). **Design
+> rulings:** offsets are DERIVED and computed everywhere, never persisted and never exposed in the UI;
+> precedence is settings > controller.yaml `db_dump_schedule` > "02:30" (mirrors PasswordHash); a change
+> applies WITHOUT restart via the new scheduler seam `UpdateDaily` (per-daily-job buffered `resched`
+> chan + a select case in `runDailyJob`). New pure package `internal/backupwindow` holds all the time
+> math (ParseHHMM/FmtHHMM/LegTimes/GateWindow/EffectiveWindow). **Disk-tier (whole-guest PBS/vzdump)
+> gate:** the quiesce loop's SCHEDULED cycles run only inside [W+2h, W+6h) (wall-clock Europe/Budapest),
+> with a safety valve — last successful backup older than cadence+24h (or none) runs regardless, so a
+> box only ever on outside its window never starves. **Manual "Mentés most"/TriggerNow is NEVER gated**
+> (bypasses runOnce). The `quiesce.Backend.Due` seam now also returns the backup age (from the agent's
+> own `/backup/due`); the agent, its cadence, and `/backup/due` are untouched. Window read fresh each
+> poll (WindowStartFn) so runtime changes take effect. Cadence defaults to 24h controller-side (the
+> response carries no cadence). Backup page gets a "Mentési időablak" card (time input + derived rows +
+> the "kb. W+2h–W+6h között" rendszermentés line); POST /backups/window (RequireAuth+CsrfProtect).
+
 
 > **2026-07-24 — v0.167.0 (outlined logo + favicon — Part 4 unblocked).** Viktor pushed the
 > text-outlined `logo.svg` to felhom.eu `main` (`be9edb4`); the wordmark is now 17 real `<path>`