Fix snapshot role — XO REST API, fix playbook host targeting

- roles/snapshot/tasks/main.yml: replace xe CLI with XO REST API
  - POST /rest/v0/vms/<uuid>/actions/snapshot?sync=true
  - stores returned snapshot UUID as snapshot_id
  - baremetal: skips gracefully with warning
- playbooks/snapshot_pre.yml: target linux_hosts only (was all)
- playbooks/linux_patch.yml: remove snapshot + report roles (snapshot is separate step)
- playbooks/site_maintenance.yml: remove bootstrap play (handled per-playbook),
  remove windows_patch import (WinRM not implemented)

playbooks/snapshot_pre.yml

@@ -1,12 +1,21 @@
 ---
+# =============================================================================
+# playbooks/snapshot_pre.yml
+# Pre-patch snapshots for Linux guest VMs via hypervisor API.
+# Targets linux_hosts only — snapshots taken per-VM before patching.
+# XCP-NG: uses XO REST API (xcpng_vm_uuid required per host)
+# Proxmox: uses community.general.proxmox_snap (proxmox_vmid required per host)
+# Baremetal: snapshot tasks skipped automatically (no hypervisor_type match)
+# =============================================================================
+
 - name: Bootstrap — ensure Python is available
-  hosts: all
+  hosts: linux_hosts
   gather_facts: false
   tasks:
     - ansible.builtin.import_tasks: ../roles/preflight/tasks/bootstrap.yml
 
 - name: Pre-patch snapshot
-  hosts: all
+  hosts: linux_hosts
   gather_facts: true
   roles:
     - snapshot