Preserve source group hooks through the API

internal/server/http/p2r01_test.go

@@ -153,6 +153,8 @@ func TestSourceGroupsCRUD(t *testing.T) {
 			},
 			"retry_max":             3,
 			"retry_backoff_seconds": 60,
+			"pre_hook":              "prepare-db",
+			"post_hook":             "resume-db",
 		}, cookie)
 	if status != 201 {
 		t.Fatalf("create status: %d, body: %+v", status, body)
@@ -161,6 +163,16 @@ func TestSourceGroupsCRUD(t *testing.T) {
 	if gid == "" {
 		t.Fatalf("create: no id returned: %+v", body)
 	}
+	if body["has_pre_hook"] != true || body["has_post_hook"] != true {
+		t.Fatalf("create hook indicators: %+v", body)
+	}
+	stored, err := st.GetSourceGroup(context.Background(), hostID, gid)
+	if err != nil {
+		t.Fatalf("get stored group: %v", err)
+	}
+	if stored.PreHook == "prepare-db" || stored.PostHook == "resume-db" || stored.PreHook == "" || stored.PostHook == "" {
+		t.Fatalf("hooks not encrypted at rest: pre=%q post=%q", stored.PreHook, stored.PostHook)
+	}
 
 	// Duplicate name → 409.
 	status, _ = doJSON(t, url, "POST", "/api/hosts/"+hostID+"/source-groups",
@@ -185,6 +197,20 @@ func TestSourceGroupsCRUD(t *testing.T) {
 	if got := body["name"]; got != "system" {
 		t.Errorf("rename: got %v want system", got)
 	}
+	stored, _ = st.GetSourceGroup(context.Background(), hostID, gid)
+	if stored.PreHook == "" || stored.PostHook == "" {
+		t.Fatal("PUT without hook fields cleared existing hooks")
+	}
+
+	// Explicit empty hook clears only that hook; plaintext is never returned.
+	status, body = doJSON(t, url, "PUT", "/api/hosts/"+hostID+"/source-groups/"+gid,
+		map[string]any{"name": "system", "includes": []string{"/etc"}, "pre_hook": ""}, cookie)
+	if status != 200 || body["has_pre_hook"] != false || body["has_post_hook"] != true {
+		t.Fatalf("clear hook status=%d body=%+v", status, body)
+	}
+	if _, exposed := body["post_hook"]; exposed {
+		t.Fatal("source-group response exposed hook plaintext field")
+	}
 
 	// Delete.
 	status, _ = doJSON(t, url, "DELETE", "/api/hosts/"+hostID+"/source-groups/"+gid, nil, cookie)