feat: add Patchmon Sync job

Syncs patchmon field on instances by querying the Patchmon hosts API
and matching hostnames. API token masked as REDACTED in responses.
seedJobs now uses INSERT OR IGNORE so new jobs are seeded on existing
installs without re-running the full seed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/jobs.js

@@ -35,10 +35,42 @@ async function tailscaleSyncHandler(cfg) {
   return { summary: `${updated} updated of ${instances.length}` };
 }
 
+// ── Patchmon Sync ─────────────────────────────────────────────────────────────
+
+async function patchmonSyncHandler(cfg) {
+  const { api_url, api_token } = cfg;
+  if (!api_url || !api_token) throw new Error('Patchmon not configured — set API URL and token');
+
+  const res = await fetch(api_url, {
+    headers: { Authorization: `Basic ${api_token}` },
+  });
+  if (!res.ok) throw new Error(`Patchmon API ${res.status}`);
+
+  const data = await res.json();
+  const items = Array.isArray(data) ? data : (data.hosts ?? data.data ?? []);
+  const hostSet = new Set(
+    items.map(h => (typeof h === 'string' ? h : (h.name ?? h.hostname ?? h.host ?? '')))
+         .filter(Boolean)
+  );
+
+  const instances = getInstances();
+  let updated = 0;
+  for (const inst of instances) {
+    const newPatchmon = hostSet.has(inst.name) ? 1 : 0;
+    if (newPatchmon !== inst.patchmon) {
+      const { id: _id, created_at: _ca, updated_at: _ua, ...instData } = inst;
+      updateInstance(inst.vmid, { ...instData, patchmon: newPatchmon });
+      updated++;
+    }
+  }
+  return { summary: `${updated} updated of ${instances.length}` };
+}
+
 // ── Registry ──────────────────────────────────────────────────────────────────
 
 const HANDLERS = {
   tailscale_sync: tailscaleSyncHandler,
+  patchmon_sync:  patchmonSyncHandler,
 };
 
 // ── Public API ────────────────────────────────────────────────────────────────