[backend] fix sandbox constraints handling
[api] move all patchinfo specific code into a patchinfo model