Don't 500 on uptime stop when its data dir is unwritable

Stop now persists the tracking flag, and the save created the data
directory unguarded. Where that fails (an unprivileged host or CI
runner) the save is now logged and reported false, as its docstring
already promised, instead of raising.

backend/app/services/uptime_service.py

@@ -65,7 +65,11 @@ class UptimeService:
         that had stopped being updated. Now the write is atomic and the failure
         is logged and returned, so a caller can tell "saved" from "could not".
         """
-        cls._ensure_data_dir()
+        try:
+            cls._ensure_data_dir()
+        except OSError as e:
+            logger.warning('Could not create uptime data dir %s: %s', cls.DATA_DIR, e)
+            return False
         result = save_json_config(cls.UPTIME_FILE, history)
         if not result['success']:
             logger.warning('Could not save uptime history to %s: %s',

backend/tests/test_alerting_resumes_at_boot.py

@@ -99,3 +99,15 @@ def test_resume_does_not_create_an_uncreatable_data_dir(uptime, tmp_path, monkey
     monkeypatch.setattr(UptimeService, 'UPTIME_FILE', str(data_dir / 'uptime_history.json'))
     UptimeService.resume_if_enabled()
     assert uptime == [] and not data_dir.exists()
+
+
+def test_stopping_tracking_survives_an_uncreatable_data_dir(uptime, tmp_path, monkeypatch):
+    """Stop persists the tracking flag; an unwritable data dir must cost the
+    flag, not turn the request into a 500."""
+    blocker = tmp_path / 'not-a-dir'
+    blocker.write_text('')
+    data_dir = blocker / 'serverkit'
+    monkeypatch.setattr(UptimeService, 'DATA_DIR', str(data_dir))
+    monkeypatch.setattr(UptimeService, 'UPTIME_FILE', str(data_dir / 'uptime_history.json'))
+    UptimeService.start_tracking()
+    assert UptimeService.stop_tracking()['success'] is True