testing: bootstrap UI, agent reliability, NS-01..04 + alert username

Smoothes the rough edges that came up exercising a live deployment.

First-run bootstrap UI: /bootstrap renders a username + password form
that uses the in-memory token directly (operator no longer copies it
out of the log); /login redirects there while bootstrap is available.

Agent reliability: failJob synthetic envelopes so command.run early
returns no longer hang the server-side job; runtime probe of restic
restore --help drives --no-ownership instead of version sniffing
(0.18.x had it removed). Server unit re-shaped: ProtectSystem=full
plus ReadWritePaths=/etc/restic-manager, no ProtectHome — restore
can now write anywhere a user might want.

Restore wizard: default target is /root/rm-restore/<job-id>/ with
clearer help text. Re-init confirm input uses .field (was .input,
which doesn't exist — text was invisible).

NS-01 host delete: store DeleteHost, admin-band /hosts/{id}/delete
with hostname-confirm danger zone, audit, FK cascade, live WS close.

NS-02 enrollment-token recovery: outstanding-tokens panel on
/hosts/new, regenerate (preserves attachments) and revoke handlers
+ audit, store-level ListOutstandingEnrollmentTokens and
DeleteEnrollmentToken.

NS-03 repo init / probe surface: migration 0020 adds
hosts.repo_status + repo_status_error; WS handler projects every
init job's outcome onto the host row (idempotent already-initialised
collapses to ready); creds-save resets status and dispatches a fresh
probe; /hosts/{id}/repo/probe retry endpoint with banner.

NS-04 dashboard live + sort + filter: query-string filter
(q/status/repo_status/tag/sort/dir), 5s htmx live poll mirroring the
alerts pattern with a localStorage live toggle, sortable column
headers, filter row + clear.

Alerts page: ack'd-by line resolves user_id ULID to username.

Compose.yaml ignored — host-specific.

deploy/Dockerfile.server

@@ -34,6 +34,13 @@ RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
         -o /out/restic-manager-server \
         ./cmd/server
 
+# Empty /data skeleton so the runtime image carries an existing,
+# nonroot-owned mount point. Docker copies that ownership onto a
+# named volume the first time it's created, which avoids the
+# "permission denied" trap on /data/secret.key when the operator
+# uses a default `volumes: { rm-data: {} }` declaration.
+RUN mkdir -p /out/data
+
 # Agents: identical across image arches — an arm64 server image still
 # ships an amd64 agent binary for amd64 endpoints to download.
 RUN mkdir -p /out/agent-binaries && \
@@ -72,5 +79,9 @@ COPY --chmod=0755 deploy/install/install.sh /opt/restic-manager/dist/install/ins
 COPY --chmod=0644 deploy/install/install.ps1 /opt/restic-manager/dist/install/install.ps1
 COPY --chmod=0644 deploy/install/restic-manager-agent.service /opt/restic-manager/dist/install/restic-manager-agent.service
 
+# Pre-created data dir owned by nonroot so a fresh named volume
+# inherits the right ownership.
+COPY --from=build --chown=nonroot:nonroot /out/data /data
+
 EXPOSE 8443
 ENTRYPOINT ["/usr/local/bin/restic-manager-server"]