P2-04.5: kill host.default_paths in favour of manual schedules

Two independent path lists for "what does this host back up?" was
a real divergence footgun — operator types one set at Add-host time
and a different set into a schedule, both end up in the same repo,
the snapshot history looks fine until restore. Resolution: drop
host.default_paths entirely; add a `manual` flag on schedules.
A manual schedule has paths/excludes/tags/retention like any other
but no cron — it fires only via per-schedule Run-now. Single source
of truth for what gets backed up.

Schema (migration 0007):
* schedules.manual INTEGER NOT NULL DEFAULT 0.
* For every host with non-empty default_paths, seed a manual
  schedule with those paths and bump host_schedule_version.
* ALTER TABLE hosts DROP COLUMN default_paths.
* ALTER TABLE enrollment_tokens RENAME COLUMN default_paths
  TO initial_paths.

Original draft of this migration rebuilt hosts via the
create-new + drop-old + rename-new pattern. With foreign_keys=ON
(set in the connection DSN), DROP TABLE on the parent fired
ON DELETE CASCADE on every child of hosts(id) — schedules /
jobs / snapshots / host_credentials all wiped on the smoke env
when I tried it. SQLite 3.35+ supports column-level ALTERs
directly, so we skip the rebuild dance and avoid the cascade
trap. Six lines of SQL instead of sixty, no FK risk.

Run-now rewiring:
* New `dispatchScheduleNow(hostID, scheduleID, conn?)` helper
  unifies the agent-driven path (cron fire → schedule.fire →
  OnScheduleFire callback) and the UI-driven path (operator
  clicks Run-now on a schedule row). Conn arg is optional; nil
  falls back to Hub.Send.
* New POST /hosts/{id}/schedules/{sid}/run endpoint — per-row
  Run-now button on the schedules list.
* Dashboard's per-host Run-now (handleUIRunBackup) now picks the
  host's only enabled manual schedule, falls back to the only
  enabled schedule, else returns "pick one in Schedules tab".
  Keeps one-click for the common case.

Agent:
* Scheduler skips manual schedules in cron build (silent — they're
  a normal data shape, not an error).
* Wire Schedule struct gains Manual flag.
* Schedule.fire flow unchanged — the agent only ever fires
  non-manual schedules anyway.

UI:
* Add-host form retitled "Initial schedule · manual" so the
  operator knows the paths become an editable schedule under
  the Schedules tab. Result page calls out the manual schedule
  + points at Host > Schedules.
* Schedule edit form: "Manual schedule" checkbox at the top of
  the When section; toggling it hides/shows the cron field via
  inline JS. Server-side validator skips the cron requirement
  when manual=true.
* Schedule list shows a "manual" tag under the status pill and
  renders the When column as "— run-now only —" for manual rows.
  Each row gets a Run-now button when the schedule is enabled
  and the host is online.

Tests + go test ./... green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/store/hosts.go

@@ -17,25 +17,17 @@ func (s *Store) CreateHost(ctx context.Context, h Host, agentTokenHash, certPinS
 	if err != nil {
 		return fmt.Errorf("store: marshal tags: %w", err)
 	}
-	if h.DefaultPaths == nil {
-		h.DefaultPaths = []string{}
-	}
-	defaultPaths, err := json.Marshal(h.DefaultPaths)
-	if err != nil {
-		return fmt.Errorf("store: marshal default_paths: %w", err)
-	}
 	_, err = s.db.ExecContext(ctx,
 		`INSERT INTO hosts (
 			id, name, os, arch, agent_version, restic_version, protocol_version,
 			enrolled_at, status, tags,
-			agent_token_hash, cert_pin_sha256, default_paths
-		 ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'offline', ?, ?, ?, ?)`,
+			agent_token_hash, cert_pin_sha256
+		 ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'offline', ?, ?, ?)`,
 		h.ID, h.Name, h.OS, h.Arch,
 		h.AgentVersion, h.ResticVersion, h.ProtocolVersion,
 		h.EnrolledAt.UTC().Format(time.RFC3339Nano),
 		string(tags),
-		agentTokenHash, certPinSHA256,
-		string(defaultPaths))
+		agentTokenHash, certPinSHA256)
 	if err != nil {
 		return fmt.Errorf("store: create host: %w", err)
 	}
@@ -50,7 +42,7 @@ func (s *Store) LookupHostByAgentToken(ctx context.Context, tokenHash string) (*
 			enrolled_at, last_seen_at, status, repo_id, tags,
 			current_job_id, last_backup_at, last_backup_status,
 			repo_size_bytes, snapshot_count, open_alert_count,
-			applied_schedule_version, default_paths, repo_initialised_at
+			applied_schedule_version, repo_initialised_at
 		 FROM hosts WHERE agent_token_hash = ?`,
 		tokenHash)
 	return scanHost(row)
@@ -63,7 +55,7 @@ func (s *Store) GetHost(ctx context.Context, id string) (*Host, error) {
 			enrolled_at, last_seen_at, status, repo_id, tags,
 			current_job_id, last_backup_at, last_backup_status,
 			repo_size_bytes, snapshot_count, open_alert_count,
-			applied_schedule_version, default_paths, repo_initialised_at
+			applied_schedule_version, repo_initialised_at
 		 FROM hosts WHERE id = ?`, id)
 	return scanHost(row)
 }
@@ -124,7 +116,7 @@ func (s *Store) ListHosts(ctx context.Context) ([]Host, error) {
 			enrolled_at, last_seen_at, status, repo_id, tags,
 			current_job_id, last_backup_at, last_backup_status,
 			repo_size_bytes, snapshot_count, open_alert_count,
-			applied_schedule_version, default_paths, repo_initialised_at
+			applied_schedule_version, repo_initialised_at
 		 FROM hosts ORDER BY name`)
 	if err != nil {
 		return nil, fmt.Errorf("store: list hosts: %w", err)
@@ -162,7 +154,6 @@ func scanHostRow(s hostScanner) (*Host, error) {
 		repoID, currentJob, lastBkSt  sql.NullString
 		enrolled                      string
 		tags                          string
-		defaultPaths                  string
 		repoInitAt                    sql.NullString
 	)
 	err := s.Scan(&h.ID, &h.Name, &h.OS, &h.Arch,
@@ -170,7 +161,7 @@ func scanHostRow(s hostScanner) (*Host, error) {
 		&enrolled, &lastSeen, &h.Status, &repoID, &tags,
 		&currentJob, &lastBackupAt, &lastBkSt,
 		&h.RepoSizeBytes, &h.SnapshotCount, &h.OpenAlertCount,
-		&h.AppliedScheduleVersion, &defaultPaths, &repoInitAt)
+		&h.AppliedScheduleVersion, &repoInitAt)
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
 			return nil, ErrNotFound
@@ -211,9 +202,6 @@ func scanHostRow(s hostScanner) (*Host, error) {
 	if tags != "" {
 		_ = json.Unmarshal([]byte(tags), &h.Tags)
 	}
-	if defaultPaths != "" {
-		_ = json.Unmarshal([]byte(defaultPaths), &h.DefaultPaths)
-	}
 	if repoInitAt.Valid {
 		t, err := time.Parse(time.RFC3339Nano, repoInitAt.String)
 		if err != nil {