fix: reset stale remote agent updates after sac-api restart (0.4.3)

Clear zombie running jobs on deploy and add admin API to cancel a stuck job.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_agent_update.py

@@ -224,3 +224,45 @@ def test_api_agent_update_fallback_ssh(jwt_headers, client, db_session, monkeypa
     job = wait_remote_job(client, host.id, jwt_headers)
     assert job["ok"] is True
     assert job["product_version"] == "2.1.0-SAC"
+
+
+def test_clear_stale_running_remote_actions(db_session):
+    from app.services.host_remote_actions import clear_stale_running_remote_actions
+
+    host = Host(
+        hostname="stale-win",
+        os_family="windows",
+        product="rdp-login-monitor",
+        agent_update_state="running",
+        remote_action={"status": "running", "message": "Подключение…"},
+    )
+    db_session.add(host)
+    db_session.commit()
+
+    cleared = clear_stale_running_remote_actions(db_session, reason="test reset")
+    assert cleared == ["stale-win"]
+    db_session.refresh(host)
+    assert host.agent_update_state == "failed"
+    assert host.remote_action["status"] == "failed"
+    assert host.remote_action["ok"] is False
+
+
+def test_cancel_host_remote_job_api(jwt_headers, client, db_session):
+    host = Host(
+        hostname="cancel-me",
+        os_family="windows",
+        product="rdp-login-monitor",
+        agent_update_state="running",
+        remote_action={"status": "running", "title": "Обновление через WinRM"},
+    )
+    db_session.add(host)
+    db_session.commit()
+
+    response = client.post(
+        f"/api/v1/hosts/{host.id}/actions/remote-job/cancel",
+        headers=jwt_headers,
+    )
+    assert response.status_code == 200
+    body = response.json()
+    assert body["active"] is False
+    assert body["status"] == "failed"