Restart-safe grace window (schema amendment)

[kymil4]

What to build

A commitment in grace currently loses its 6 h grace-expiry job on a server restart (only cadence/deadline/win-back are rebuilt). Persist a grace-start timestamp so rebuild_from_db() can re-arm the grace-expiry job for the remaining window.

HITL: this amends the normative §8.1 DDL (adds a column), which requires human ratification — precedent: ADR-0002 added last_contact_at. Decide the column and record an ADR + spec update before implementing.

Context: deferred from the PR #27 review.

Acceptance criteria

• A schema amendment (grace-start timestamp) is ratified and reflected in spec §8.1 + an ADR
• Entering grace records the grace-start time
• rebuild_from_db() re-arms the grace-expiry job for the remaining window after a restart
• Test: a grace commitment past its window is missed on boot; one still inside keeps a re-armed job

Blocked by

None - can start immediately