agent+server: P2R-11 pre/post hook execution for backup jobs

Agent: new runner.BackupHooks struct + runHook helper invoked via
/bin/sh -c (cmd.exe /C on Windows). pre_hook non-zero exit aborts
the backup; post_hook always runs with RM_JOB_STATUS=succeeded|failed
in env. Output streamed as 'hook(<phase>): …' log.stream lines.
Hooks only run for kind=backup (other kinds skip both phases).

Server: resolveBackupHooks resolves group → host default → empty,
decrypts via crypto.AEAD with per-slot ad bytes, plumbs plaintext
into CommandRunPayload for both schedule.fire and per-group
Run-now dispatch sites. Decrypt failures degrade silently to no
hook so a malformed blob can't poison every backup.

internal/store/hosts.go

@@ -158,7 +158,7 @@ func scanHostRow(s hostScanner) (*Host, error) {
 		enrolled                     string
 		tags                         string
 		bwUp, bwDown                 sql.NullInt64
-		preHook, postHook            []byte
+		preHook, postHook            sql.NullString
 	)
 	err := s.Scan(&h.ID, &h.Name, &h.OS, &h.Arch,
 		&h.AgentVersion, &h.ResticVersion, &h.ProtocolVersion,
@@ -215,18 +215,22 @@ func scanHostRow(s hostScanner) (*Host, error) {
 		v := int(bwDown.Int64)
 		h.BandwidthDownKBps = &v
 	}
-	h.PreHookDefault = preHook
-	h.PostHookDefault = postHook
+	if preHook.Valid {
+		h.PreHookDefault = preHook.String
+	}
+	if postHook.Valid {
+		h.PostHookDefault = postHook.String
+	}
 	return &h, nil
 }
 
 // SetHostHooks replaces the host-wide pre/post hook defaults. Pass
-// nil/empty to clear that hook. Stored verbatim — caller is expected
-// to encrypt the bytes before they reach this layer.
-func (s *Store) SetHostHooks(ctx context.Context, hostID string, pre, post []byte) error {
+// the empty string to clear that hook. Stored verbatim — caller is
+// expected to encrypt before they reach this layer.
+func (s *Store) SetHostHooks(ctx context.Context, hostID string, pre, post string) error {
 	_, err := s.db.ExecContext(ctx,
 		`UPDATE hosts SET pre_hook_default = ?, post_hook_default = ? WHERE id = ?`,
-		nullableBytes(pre), nullableBytes(post), hostID)
+		nullableString(pre), nullableString(post), hostID)
 	if err != nil {
 		return fmt.Errorf("store: set host hooks: %w", err)
 	}