testing: bootstrap UI, agent reliability, NS-01..04 + alert username

Smoothes the rough edges that came up exercising a live deployment.

First-run bootstrap UI: /bootstrap renders a username + password form
that uses the in-memory token directly (operator no longer copies it
out of the log); /login redirects there while bootstrap is available.

Agent reliability: failJob synthetic envelopes so command.run early
returns no longer hang the server-side job; runtime probe of restic
restore --help drives --no-ownership instead of version sniffing
(0.18.x had it removed). Server unit re-shaped: ProtectSystem=full
plus ReadWritePaths=/etc/restic-manager, no ProtectHome — restore
can now write anywhere a user might want.

Restore wizard: default target is /root/rm-restore/<job-id>/ with
clearer help text. Re-init confirm input uses .field (was .input,
which doesn't exist — text was invisible).

NS-01 host delete: store DeleteHost, admin-band /hosts/{id}/delete
with hostname-confirm danger zone, audit, FK cascade, live WS close.

NS-02 enrollment-token recovery: outstanding-tokens panel on
/hosts/new, regenerate (preserves attachments) and revoke handlers
+ audit, store-level ListOutstandingEnrollmentTokens and
DeleteEnrollmentToken.

NS-03 repo init / probe surface: migration 0020 adds
hosts.repo_status + repo_status_error; WS handler projects every
init job's outcome onto the host row (idempotent already-initialised
collapses to ready); creds-save resets status and dispatches a fresh
probe; /hosts/{id}/repo/probe retry endpoint with banner.

NS-04 dashboard live + sort + filter: query-string filter
(q/status/repo_status/tag/sort/dir), 5s htmx live poll mirroring the
alerts pattern with a localStorage live toggle, sortable column
headers, filter row + clear.

Alerts page: ack'd-by line resolves user_id ULID to username.

Compose.yaml ignored — host-specific.

internal/server/http/ui_alerts.go

@@ -18,6 +18,7 @@ type alertsPage struct {
 	Alerts     []store.Alert
 	Counts     alertCounts
 	HostNames  map[string]string // host_id → name for table rendering
+	Usernames  map[string]string // user_id → username for the "ack'd by …" line
 	RefreshURL string            // self-URL for the live-refresh poll
 }
 
@@ -56,6 +57,7 @@ func (s *Server) handleUIAlerts(w stdhttp.ResponseWriter, r *stdhttp.Request) {
 		Filter:     f,
 		Alerts:     alerts,
 		HostNames:  map[string]string{},
+		Usernames:  map[string]string{},
 		RefreshURL: r.URL.RequestURI(),
 	}
 	if hosts, err := s.deps.Store.ListHosts(r.Context()); err == nil {
@@ -63,6 +65,17 @@ func (s *Server) handleUIAlerts(w stdhttp.ResponseWriter, r *stdhttp.Request) {
 			page.HostNames[h.ID] = h.Name
 		}
 	}
+	// Resolve user IDs that appear on acknowledged rows to usernames so
+	// the "ack'd by …" line shows a human name rather than the
+	// underlying ULID. Cheap at fleet sizes we care about (one extra
+	// query per alerts page render). Disabled users are still resolved
+	// — operators want to know *who* ack'd, even if the account is
+	// since gone.
+	if users, err := s.deps.Store.ListUsers(r.Context(), store.UserSort{}); err == nil {
+		for _, usr := range users {
+			page.Usernames[usr.ID] = usr.Username
+		}
+	}
 	page.Counts = computeAlertCounts(s, r)
 
 	view := s.baseView(r, u)