ctl restart --max-surge and --max-unavailable

A model's replicas restarted one at a time, always. RestartPace says how
many restart at once: MaxSurge beside themselves (replacement first),
MaxUnavailable stopped first (no room needed, out while loading); the
reconciler begins that many per model per pass. The admin API takes
max_surge and max_unavailable on POST /api/v1/restart.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/admin-api.openapi.json

@@ -5592,6 +5592,13 @@
           "in_place": {
             "type": "boolean",
             "description": "InPlace stops each replica before starting its replacement, rather than starting the replacement beside it first."
+          },
+          "max_surge": {
+            "type": "integer",
+            "description": "MaxSurge is how many of a model's replicas are replaced beside themselves at once, MaxUnavailable how many are stopped first at once; both zero is one at a time, replaced beside itself."
+          },
+          "max_unavailable": {
+            "type": "integer"
           }
         }
       },