server: maintenance ticker drives forget/prune/check on cadence

Wires a 60s server-side ticker to the pure-logic maintenance.Decide
introduced in the previous commit. Decisions flow through a new
DispatchMaintenance method on *Server, which:

  - skips offline hosts (no pending_runs queueing — maintenance is
    not a backup, missed fires shouldn't pile up)
  - silently skips prune when admin creds aren't bound
  - pushes admin creds before prune, then dispatches with
    RequiresAdminCreds=true (same as operator-driven prune)
  - persists job rows with actor_kind="system"

Reshapes the forget wire payload from a single RetentionPolicy to a
ForgetGroups list (one tag + per-group keep-* per source group). The
agent walks the groups and runs `restic forget --tag <name> --keep-*`
once per group. Dead-code removed: CommandRunPayload.RetentionPolicy,
the old forget JSON-decode in cmd/agent, and the single-policy form of
restic.RunForget.

cmd/agent/main.go

@@ -2,7 +2,6 @@ package main
 
 import (
 	"context"
-	"encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -336,28 +335,26 @@ func (d *dispatcher) runJob(ctx context.Context, p api.CommandRunPayload, tx wsc
 			slog.Info("agent: init job complete", "job_id", p.JobID)
 		}()
 	case api.JobForget:
-		var policy restic.ForgetPolicy
-		if len(p.RetentionPolicy) > 0 {
-			var raw struct {
-				KeepLast    *int `json:"keep_last,omitempty"`
-				KeepHourly  *int `json:"keep_hourly,omitempty"`
-				KeepDaily   *int `json:"keep_daily,omitempty"`
-				KeepWeekly  *int `json:"keep_weekly,omitempty"`
-				KeepMonthly *int `json:"keep_monthly,omitempty"`
-				KeepYearly  *int `json:"keep_yearly,omitempty"`
-			}
-			if err := json.Unmarshal(p.RetentionPolicy, &raw); err != nil {
-				return fmt.Errorf("forget: decode retention_policy: %w", err)
-			}
-			policy = restic.ForgetPolicy{
-				KeepLast: raw.KeepLast, KeepHourly: raw.KeepHourly,
-				KeepDaily: raw.KeepDaily, KeepWeekly: raw.KeepWeekly,
-				KeepMonthly: raw.KeepMonthly, KeepYearly: raw.KeepYearly,
-			}
+		if len(p.ForgetGroups) == 0 {
+			return fmt.Errorf("forget: command.run carried no forget_groups (server didn't populate them)")
 		}
-		slog.Info("agent: accepting forget job", "job_id", p.JobID, "policy", p.RetentionPolicy)
+		groups := make([]restic.ForgetGroup, 0, len(p.ForgetGroups))
+		for _, g := range p.ForgetGroups {
+			groups = append(groups, restic.ForgetGroup{
+				Tag: g.Tag,
+				Policy: restic.ForgetPolicy{
+					KeepLast:    g.Policy.KeepLast,
+					KeepHourly:  g.Policy.KeepHourly,
+					KeepDaily:   g.Policy.KeepDaily,
+					KeepWeekly:  g.Policy.KeepWeekly,
+					KeepMonthly: g.Policy.KeepMonthly,
+					KeepYearly:  g.Policy.KeepYearly,
+				},
+			})
+		}
+		slog.Info("agent: accepting forget job", "job_id", p.JobID, "groups", len(groups))
 		go func() {
-			if err := r.RunForget(ctx, p.JobID, policy); err != nil {
+			if err := r.RunForget(ctx, p.JobID, groups); err != nil {
 				slog.Warn("agent: forget job failed", "job_id", p.JobID, "err", err)
 				return
 			}