feat(restart): host-resolvable timezone dropdown + heal-on-read

[AdaInTheLab]

Summary

The graceful-restart feature called TimeZoneInfo.FindSystemTimeZoneById with whatever string was in the persisted config. On .NET Framework 4.8 / Windows, IANA IDs like "America/Los_Angeles" don't resolve, so the 30-second tick threw, the catch logged "bad schedule config" forever, and the daily restart never fired. Observed in the wild with "ScheduledTimezone":"UTC-5" — not even an IANA ID — where nobody realized the feature was a silent no-op. The free-text UI labeled "TIMEZONE (IANA)" was actively setting users up to type in strings the host couldn't parse.

Two-part fix

1. Heal-on-read in LoadPersistedSettings

After deserializing, probe the configured timezone via FindSystemTimeZoneById. If it doesn't resolve (or is null/empty), fall back to TimeZoneInfo.Local.Id (TimeZoneInfo.Utc.Id if Local has no Id), log one INFO line about the heal, and persist the corrected JSON back to the settings row.

The next boot is clean — no spam, no recurring warning, no second heal. The tick path itself is unchanged: it still gates on FindSystemTimeZoneById, so a hand-edited bad value in the DB between boots is still caught and warned about (just now without the silent-feature-failure mode).

2. New GET /api/server/timezones endpoint

Projects TimeZoneInfo.GetSystemTimeZones() to { id, displayName, baseUtcOffsetMinutes }, sorted by BaseUtcOffset then DisplayName. The IDs returned are whatever the runtime accepts back through FindSystemTimeZoneById on THIS host — Windows registry IDs on .NET Framework / Windows, IANA on .NET Core / Linux. That's the point: we hand the panel a list of strings we know will round-trip, and the panel saves the raw Id verbatim. Authorize-only, no role gate — same as /api/server/info, since the list is host metadata, not anything sensitive.

3. Frontend

SettingsView.vue swaps the InputText for a PrimeVue Select bound to that endpoint with optionLabel=displayName, optionValue=id, filter enabled (the list can be 100+ entries). Editable mode is only enabled if the fetch fails so admins can still hand-type a value as an escape hatch. i18n strings updated across all eight locales (en/de/fr/es translated; ja/ko/zh-CN/zh-TW carry English placeholders pending translation — consistent with the existing pattern in this file).

Tests

src/KitsuneCommand.Tests/Services/GracefulRestartFeatureTests.cs covers both paths: unresolvable timezone heals to Local and persists exactly once; resolvable timezone passes through without touching the DB so we don't churn the settings row on every boot.

Test plan

• Build passes on Windows .NET Framework 4.8
• New GracefulRestartFeatureTests pass
• Deploy to a Windows box with a stored IANA-format TZ — confirm INFO heal-on-read line + DB row updated to a Windows TZ ID
• Open Settings → Server Restart in browser — confirm dropdown populates with host-resolvable IDs, current selection survives reload
• Sanity: still works on Linux (IANA IDs round-trip natively)

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 63.63636% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
frontend/src/views/SettingsView.vue	66.66%	3 Missing ⚠️
frontend/src/api/server.ts	50.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!