server: maintenance ticker drives forget/prune/check on cadence

Wires a 60s server-side ticker to the pure-logic maintenance.Decide
introduced in the previous commit. Decisions flow through a new
DispatchMaintenance method on *Server, which:

  - skips offline hosts (no pending_runs queueing — maintenance is
    not a backup, missed fires shouldn't pile up)
  - silently skips prune when admin creds aren't bound
  - pushes admin creds before prune, then dispatches with
    RequiresAdminCreds=true (same as operator-driven prune)
  - persists job rows with actor_kind="system"

Reshapes the forget wire payload from a single RetentionPolicy to a
ForgetGroups list (one tag + per-group keep-* per source group). The
agent walks the groups and runs `restic forget --tag <name> --keep-*`
once per group. Dead-code removed: CommandRunPayload.RetentionPolicy,
the old forget JSON-decode in cmd/agent, and the single-policy form of
restic.RunForget.

internal/agent/runner/runner.go

@@ -206,18 +206,20 @@ func (r *Runner) RunInit(ctx context.Context, jobID string) error {
 	return nil
 }
 
-// RunForget executes a forget job against the configured repo with
-// the given retention policy. Same envelope shape as RunBackup so
-// the live log viewer + job lifecycle work without special-casing.
-// On success refreshes the snapshot projection (forget rewrites the
-// snapshot index — the host's snapshot list shrinks).
-func (r *Runner) RunForget(ctx context.Context, jobID string, policy restic.ForgetPolicy) error {
+// RunForget executes a forget job against the configured repo by
+// invoking `restic forget --tag <Tag> --keep-* …` once per group.
+// Same envelope shape as RunBackup so the live log viewer + job
+// lifecycle work without special-casing. On success refreshes the
+// snapshot projection (forget rewrites the snapshot index — the
+// host's snapshot list shrinks). Snapshot refresh runs once after
+// every group completes, not per-group.
+func (r *Runner) RunForget(ctx context.Context, jobID string, groups []restic.ForgetGroup) error {
 	startedAt := time.Now().UTC()
 	r.sendStarted(jobID, api.JobForget, startedAt)
 
 	env := r.resticEnv()
 	var seq atomic.Int64
-	err := env.RunForget(ctx, policy, r.streamHandler(jobID, &seq))
+	err := env.RunForget(ctx, groups, r.streamHandler(jobID, &seq))
 	finishedAt := time.Now().UTC()
 	r.sendFinished(jobID, finishedAt, err, nil)
 

internal/agent/runner/runner_test.go

@@ -333,8 +333,11 @@ esac
 	tx := &fakeSender{}
 	r := New(Config{ResticBin: bin}, tx, 0)
 	keepLast := 1
-	policy := restic.ForgetPolicy{KeepLast: &keepLast}
-	if err := r.RunForget(context.Background(), "job-forget", policy); err != nil {
+	groups := []restic.ForgetGroup{{
+		Tag:    "documents",
+		Policy: restic.ForgetPolicy{KeepLast: &keepLast},
+	}}
+	if err := r.RunForget(context.Background(), "job-forget", groups); err != nil {
 		t.Fatalf("RunForget: %v", err)
 	}
 	_ = firstEnvOfType(t, tx.envs, api.MsgJobStarted)