testing: bootstrap UI, agent reliability, NS-01..04 + alert username

Smoothes the rough edges that came up exercising a live deployment.

First-run bootstrap UI: /bootstrap renders a username + password form
that uses the in-memory token directly (operator no longer copies it
out of the log); /login redirects there while bootstrap is available.

Agent reliability: failJob synthetic envelopes so command.run early
returns no longer hang the server-side job; runtime probe of restic
restore --help drives --no-ownership instead of version sniffing
(0.18.x had it removed). Server unit re-shaped: ProtectSystem=full
plus ReadWritePaths=/etc/restic-manager, no ProtectHome — restore
can now write anywhere a user might want.

Restore wizard: default target is /root/rm-restore/<job-id>/ with
clearer help text. Re-init confirm input uses .field (was .input,
which doesn't exist — text was invisible).

NS-01 host delete: store DeleteHost, admin-band /hosts/{id}/delete
with hostname-confirm danger zone, audit, FK cascade, live WS close.

NS-02 enrollment-token recovery: outstanding-tokens panel on
/hosts/new, regenerate (preserves attachments) and revoke handlers
+ audit, store-level ListOutstandingEnrollmentTokens and
DeleteEnrollmentToken.

NS-03 repo init / probe surface: migration 0020 adds
hosts.repo_status + repo_status_error; WS handler projects every
init job's outcome onto the host row (idempotent already-initialised
collapses to ready); creds-save resets status and dispatches a fresh
probe; /hosts/{id}/repo/probe retry endpoint with banner.

NS-04 dashboard live + sort + filter: query-string filter
(q/status/repo_status/tag/sort/dir), 5s htmx live poll mirroring the
alerts pattern with a localStorage live toggle, sortable column
headers, filter row + clear.

Alerts page: ack'd-by line resolves user_id ULID to username.

Compose.yaml ignored — host-specific.

internal/agent/runner/runner.go

@@ -32,6 +32,11 @@ type Config struct {
 	RepoUsername  string
 	RepoPassword  string
 
+	// SupportsRestoreNoOwnership comes from a startup probe of
+	// `restic restore --help`; gates the new-dir-restore flag without
+	// relying on version sniffing.
+	SupportsRestoreNoOwnership bool
+
 	// Bandwidth caps in KB/s applied to every restic invocation.
 	// <=0 means "no cap". Per-job override: callers that build a
 	// runner per-dispatch can pass the override value here directly.
@@ -61,13 +66,14 @@ func New(cfg Config, tx Sender, progressMinPeriod time.Duration) *Runner {
 // resticEnv builds the shared restic.Env from r.cfg.
 func (r *Runner) resticEnv() restic.Env {
 	return restic.Env{
-		Bin:               r.cfg.ResticBin,
-		Version:           r.cfg.ResticVersion,
-		RepoURL:           r.cfg.RepoURL,
-		RepoUsername:      r.cfg.RepoUsername,
-		RepoPassword:      r.cfg.RepoPassword,
-		LimitUploadKBps:   r.cfg.LimitUploadKBps,
-		LimitDownloadKBps: r.cfg.LimitDownloadKBps,
+		Bin:                        r.cfg.ResticBin,
+		Version:                    r.cfg.ResticVersion,
+		RepoURL:                    r.cfg.RepoURL,
+		RepoUsername:               r.cfg.RepoUsername,
+		RepoPassword:               r.cfg.RepoPassword,
+		SupportsRestoreNoOwnership: r.cfg.SupportsRestoreNoOwnership,
+		LimitUploadKBps:            r.cfg.LimitUploadKBps,
+		LimitDownloadKBps:          r.cfg.LimitDownloadKBps,
 	}
 }