api: stats partial-update payload + ConfigUpdate.Slot + CommandRun.RequiresAdminCreds

Reshape RepoStatsPayload into pointer-field partial-update form matching
store.HostRepoStats semantics; add Slot discriminator to ConfigUpdatePayload
for admin vs repo credential routing; add RequiresAdminCreds flag to
CommandRunPayload for prune/unlock jobs that need delete authority.

internal/api/messages.go

@@ -90,14 +90,20 @@ const (
 //
 // Args is preserved as a generic free-form slice for kinds that don't
 // fit the structured fields (e.g. unlock takes none; init takes none).
+//
+// RequiresAdminCreds tells the agent to load the admin slot of its
+// secrets store rather than the everyday repo slot. Set by the server
+// only for prune and operator-triggered unlock (kinds that need delete
+// authority on a rest-server repo).
 type CommandRunPayload struct {
-	JobID           string          `json:"job_id"`
-	Kind            JobKind         `json:"kind"`
-	Args            []string        `json:"args,omitempty"`
-	Includes        []string        `json:"includes,omitempty"`
-	Excludes        []string        `json:"excludes,omitempty"`
-	Tag             string          `json:"tag,omitempty"`
-	RetentionPolicy json.RawMessage `json:"retention_policy,omitempty"`
+	JobID              string          `json:"job_id"`
+	Kind               JobKind         `json:"kind"`
+	Args               []string        `json:"args,omitempty"`
+	Includes           []string        `json:"includes,omitempty"`
+	Excludes           []string        `json:"excludes,omitempty"`
+	Tag                string          `json:"tag,omitempty"`
+	RetentionPolicy    json.RawMessage `json:"retention_policy,omitempty"`
+	RequiresAdminCreds bool            `json:"requires_admin_creds,omitempty"`
 }
 
 // CommandCancelPayload is the server → agent cancel signal.
@@ -186,15 +192,24 @@ type Snapshot struct {
 	FileCount int64     `json:"file_count,omitempty"`
 }
 
-// RepoStatsPayload — agent reports periodic repo health facts derived
-// from `restic stats` and lock-file inspection.
+// RepoStatsPayload carries a partial-update snapshot of repo health
+// facts, shipped by the agent after prune/check/unlock or a periodic
+// stats refresh. Pointer fields follow omitempty semantics: a nil
+// pointer means "no update for this field" and is omitted on the
+// wire; the server merges only the non-nil fields into its
+// host_repo_stats row (matching UpsertHostRepoStats partial-update
+// semantics). Non-pointer fields (LastCheckStatus) use the empty
+// string as the "no update" sentinel.
 type RepoStatsPayload struct {
-	SizeBytes       int64     `json:"size_bytes"`
-	SnapshotCount   int       `json:"snapshot_count"`
-	DedupRatio      float64   `json:"dedup_ratio"`
-	LastCheckAt     time.Time `json:"last_check_at,omitempty"`
-	LastCheckStatus string    `json:"last_check_status,omitempty"`
-	LockState       string    `json:"lock_state"` // locked|unlocked
+	TotalSizeBytes      *int64     `json:"total_size_bytes,omitempty"`
+	RawSizeBytes        *int64     `json:"raw_size_bytes,omitempty"`
+	UniqueFiles         *int64     `json:"unique_files,omitempty"`
+	SnapshotCount       *int64     `json:"snapshot_count,omitempty"`
+	LastCheckAt         *time.Time `json:"last_check_at,omitempty"`
+	LastCheckStatus     string     `json:"last_check_status,omitempty"`
+	LockPresent         *bool      `json:"lock_present,omitempty"`
+	LastPruneAt         *time.Time `json:"last_prune_at,omitempty"`
+	LastPruneFreedBytes *int64     `json:"last_prune_freed_bytes,omitempty"`
 }
 
 // Schedule is the agent-facing view of a slim Schedule row plus its
@@ -252,12 +267,19 @@ type ScheduleFirePayload struct {
 // ConfigUpdatePayload — server pushes per-host config (currently just
 // repo connection details). Empty fields mean "leave existing alone";
 // to clear something, send an explicit zero value.
+//
+// Slot picks which secrets-store slot the agent writes the creds to.
+// Empty / "repo" = everyday repo creds (default). "admin" = the
+// prune-capable admin user (separate slot — not loaded for backups).
+// Forwards-compatible: an agent that ignores Slot simply writes to the
+// repo slot and admin pushes become no-ops.
 type ConfigUpdatePayload struct {
 	RepoURL        string `json:"repo_url,omitempty"`
 	RepoPassword   string `json:"repo_password,omitempty"` // sensitive
 	RepoUsername   string `json:"repo_username,omitempty"`
 	RepoCredential string `json:"repo_credential,omitempty"` // sensitive (for rest server basic auth)
 	HookShell      string `json:"hook_shell,omitempty"`
+	Slot           string `json:"slot,omitempty"`
 }
 
 // AgentUpdateAvailablePayload — informational only; the agent does