testing: bootstrap UI, agent reliability, NS-01..04 + alert username

Smoothes the rough edges that came up exercising a live deployment.

First-run bootstrap UI: /bootstrap renders a username + password form
that uses the in-memory token directly (operator no longer copies it
out of the log); /login redirects there while bootstrap is available.

Agent reliability: failJob synthetic envelopes so command.run early
returns no longer hang the server-side job; runtime probe of restic
restore --help drives --no-ownership instead of version sniffing
(0.18.x had it removed). Server unit re-shaped: ProtectSystem=full
plus ReadWritePaths=/etc/restic-manager, no ProtectHome — restore
can now write anywhere a user might want.

Restore wizard: default target is /root/rm-restore/<job-id>/ with
clearer help text. Re-init confirm input uses .field (was .input,
which doesn't exist — text was invisible).

NS-01 host delete: store DeleteHost, admin-band /hosts/{id}/delete
with hostname-confirm danger zone, audit, FK cascade, live WS close.

NS-02 enrollment-token recovery: outstanding-tokens panel on
/hosts/new, regenerate (preserves attachments) and revoke handlers
+ audit, store-level ListOutstandingEnrollmentTokens and
DeleteEnrollmentToken.

NS-03 repo init / probe surface: migration 0020 adds
hosts.repo_status + repo_status_error; WS handler projects every
init job's outcome onto the host row (idempotent already-initialised
collapses to ready); creds-save resets status and dispatches a fresh
probe; /hosts/{id}/repo/probe retry endpoint with banner.

NS-04 dashboard live + sort + filter: query-string filter
(q/status/repo_status/tag/sort/dir), 5s htmx live poll mirroring the
alerts pattern with a localStorage live toggle, sortable column
headers, filter row + clear.

Alerts page: ack'd-by line resolves user_id ULID to username.

Compose.yaml ignored — host-specific.

web/templates/pages/add_host.html

@@ -22,6 +22,45 @@
     </div>
   {{end}}
 
+  {{if $page.OutstandingTokens}}
+  <div class="mt-7 panel rounded-[7px] px-5 py-4">
+    <div class="flex items-center justify-between mb-3">
+      <h3 class="text-[12px] font-semibold uppercase tracking-[0.08em] text-ink-mute">Outstanding install tokens</h3>
+      <span class="text-[11.5px] text-ink-fade">closed the install snippet tab? regenerate to get a fresh URL</span>
+    </div>
+    <table class="w-full text-[12.5px]">
+      <thead class="text-[11px] uppercase tracking-[0.08em] text-ink-fade">
+        <tr>
+          <th class="text-left font-medium pb-2 pr-4">id</th>
+          <th class="text-left font-medium pb-2 pr-4">repo</th>
+          <th class="text-left font-medium pb-2 pr-4">created</th>
+          <th class="text-left font-medium pb-2 pr-4">expires</th>
+          <th class="pb-2"></th>
+        </tr>
+      </thead>
+      <tbody>
+        {{range $page.OutstandingTokens}}
+        <tr class="border-t border-line-soft">
+          <td class="py-2.5 pr-4 mono text-ink-mute">{{.ShortHash}}…</td>
+          <td class="py-2.5 pr-4 mono text-ink-mid">{{if .RepoURL}}{{.RepoURL}}{{else}}<span class="text-ink-fade">—</span>{{end}}</td>
+          <td class="py-2.5 pr-4 text-ink-mute">{{.CreatedAt | relTime}}</td>
+          <td class="py-2.5 pr-4 text-ink-mute">{{.ExpiresAt | relTime}}</td>
+          <td class="py-2.5 text-right whitespace-nowrap">
+            <form method="post" action="/hosts/enrollment-tokens/{{.TokenHash}}/regenerate" class="inline">
+              <button type="submit" class="btn btn-sm">Regenerate</button>
+            </form>
+            <form method="post" action="/hosts/enrollment-tokens/{{.TokenHash}}/revoke" class="inline ml-1"
+                  onsubmit="return confirm('Revoke this enrolment token? Any pending install using it will fail.');">
+              <button type="submit" class="btn btn-sm btn-danger">Revoke</button>
+            </form>
+          </td>
+        </tr>
+        {{end}}
+      </tbody>
+    </table>
+  </div>
+  {{end}}
+
   <form method="post" action="/hosts/new" class="grid grid-cols-12 gap-8 mt-7">
 
     <div class="col-span-7 panel rounded-[7px] px-8 py-7">