v0.168.0: customer-configurable backup window (Mentési időablak)

ONE setting (window start W) drives every nightly leg at fixed, never-stored
offsets: DB dump at W, tier-2 at W+60m, off-box at W+105m (wrap-safe). Precedence
settings > controller.yaml db_dump_schedule > 02:30.

- scheduler.UpdateDaily: retime a daily job at runtime (no restart) via a per-job
  buffered resched chan + a select case in runDailyJob.
- new pure package internal/backupwindow (LegTimes/GateWindow/EffectiveWindow).
- quiesce disk-tier window gate: scheduled cycles run only inside [W+2h,W+6h) with a
  safety valve (age>cadence+24h runs regardless); manual TriggerNow never gated.
  Backend.Due now also returns the backup age (from the agent's own /backup/due).
- backup page: Mentési időablak card (time input + derived leg/gate rows); POST
  /backups/window validates -> saves -> UpdateDaily x3 -> flash.

Tests: 5 groups, all red-proofed. Agent/cadence//backup/due untouched.

controller/README.md

@@ -185,7 +185,8 @@ backups, monitoring and notifications. All Proxmox/disk operations are delegated
 | **System** | `internal/system/` | System info (`/proc`), CPU collector, mount points, disk usage, FS info |
 | **Monitor** | `internal/monitor/` | System health checks, storage watchdog, legacy Healthchecks pinger (deprecated) |
 | **Metrics** | `internal/metrics/` | SQLite time-series store, system + container metric collection |
-| **Scheduler** | `internal/scheduler/` | Central job scheduler (periodic + daily, skip-if-running, panic recovery) |
+| **Scheduler** | `internal/scheduler/` | Central job scheduler (periodic + daily, skip-if-running, panic recovery). `UpdateDaily` reschedules a daily job at runtime (no restart) via a per-job reschedule signal (v0.168.0). |
+| **Backupwindow** | `internal/backupwindow/` | Pure time math for the customer-configurable backup window (v0.168.0): `ParseHHMM`/`FmtHHMM`, `LegTimes` (W / W+60m / W+105m, wrap-safe), `GateWindow` ([W+2h, W+6h)), `EffectiveWindow` (settings > yaml > "02:30"). Offsets are constants — derived, never stored. |
 | **SelfUpdate** | `internal/selfupdate/` | Version checking (registry), update trigger, state persistence, startup verification |
 | **Notify** | `internal/notify/` | Email notifications via hub relay, preference sync, per-event cooldowns |
 | **Report** | `internal/report/` | Hub report builder + HTTP pusher (system, stacks, backup, health) |
@@ -655,6 +656,15 @@ retired in v0.126.0 when the moved blocks were legitimately rewritten onto the s
 
 The nightly backup has two phases that run sequentially. All paths are **per-drive** — each physical drive gets its own restic repo and per-app DB dump directories.
 
+> **Customer-configurable backup window (v0.168.0).** ONE setting on the backup page — **"Mentési
+> időablak kezdete"** (start W, default "02:30") — drives every leg at FIXED, never-stored offsets so
+> they can never be misordered: DB dump at **W**, tier-2 mirror at **W+60m**, off-box at **W+105m**
+> (wrap-safe). The whole-guest (agent PBS/vzdump) cycle is gated to **[W+2h, W+6h)** with a safety valve
+> (runs regardless once the last successful backup is older than cadence+24h, so a box only ever on
+> outside its window never starves); **manual "Mentés most" is never gated**. A saved window fans out to
+> the three daily legs via `scheduler.UpdateDaily` and takes effect **without a restart**. Precedence:
+> settings > controller.yaml `db_dump_schedule` > "02:30". See `internal/backupwindow`.
+
 > **Atomic dump writes (v0.118.0, CAMPAIGN-3 F7).** BOTH dump paths are crash-safe: the DB dump
 > (`dbdump.go` DumpOne) and the Docker-volume dump (`DumpAppVolumes`) write to a `.tmp` sibling, fsync,
 > then `os.Rename` over the restore point ONLY on success. A mid-write failure (a NFS cut mid-tar, an