Fix snapshot role — XO REST API, fix playbook host targeting

- roles/snapshot/tasks/main.yml: replace xe CLI with XO REST API
  - POST /rest/v0/vms/<uuid>/actions/snapshot?sync=true
  - stores returned snapshot UUID as snapshot_id
  - baremetal: skips gracefully with warning
- playbooks/snapshot_pre.yml: target linux_hosts only (was all)
- playbooks/linux_patch.yml: remove snapshot + report roles (snapshot is separate step)
- playbooks/site_maintenance.yml: remove bootstrap play (handled per-playbook),
  remove windows_patch import (WinRM not implemented)

playbooks/linux_patch.yml

@@ -1,4 +1,10 @@
 ---
+# =============================================================================
+# playbooks/linux_patch.yml
+# Linux-only patch run. Snapshots should be taken separately via snapshot_pre.yml
+# before running this playbook, or use site_maintenance.yml for the full sequence.
+# =============================================================================
+
 - name: Bootstrap — ensure Python is available
   hosts: linux_hosts
   gather_facts: false
@@ -9,7 +15,6 @@
   hosts: linux_hosts
   gather_facts: true
   roles:
-    - snapshot
     - preflight
     - linux_patch
-    - report
+    #- report