testing: bootstrap UI, agent reliability, NS-01..04 + alert username

Smoothes the rough edges that came up exercising a live deployment.

First-run bootstrap UI: /bootstrap renders a username + password form
that uses the in-memory token directly (operator no longer copies it
out of the log); /login redirects there while bootstrap is available.

Agent reliability: failJob synthetic envelopes so command.run early
returns no longer hang the server-side job; runtime probe of restic
restore --help drives --no-ownership instead of version sniffing
(0.18.x had it removed). Server unit re-shaped: ProtectSystem=full
plus ReadWritePaths=/etc/restic-manager, no ProtectHome — restore
can now write anywhere a user might want.

Restore wizard: default target is /root/rm-restore/<job-id>/ with
clearer help text. Re-init confirm input uses .field (was .input,
which doesn't exist — text was invisible).

NS-01 host delete: store DeleteHost, admin-band /hosts/{id}/delete
with hostname-confirm danger zone, audit, FK cascade, live WS close.

NS-02 enrollment-token recovery: outstanding-tokens panel on
/hosts/new, regenerate (preserves attachments) and revoke handlers
+ audit, store-level ListOutstandingEnrollmentTokens and
DeleteEnrollmentToken.

NS-03 repo init / probe surface: migration 0020 adds
hosts.repo_status + repo_status_error; WS handler projects every
init job's outcome onto the host row (idempotent already-initialised
collapses to ready); creds-save resets status and dispatches a fresh
probe; /hosts/{id}/repo/probe retry endpoint with banner.

NS-04 dashboard live + sort + filter: query-string filter
(q/status/repo_status/tag/sort/dir), 5s htmx live poll mirroring the
alerts pattern with a localStorage live toggle, sortable column
headers, filter row + clear.

Alerts page: ack'd-by line resolves user_id ULID to username.

Compose.yaml ignored — host-specific.

web/templates/pages/dashboard.html

@@ -121,21 +121,63 @@
     {{end}}
 
     {{/* ---------- hosts table ---------- */}}
+    {{$f := $page.Filter}}
+    {{$sortURL := $page.SortURL}}
     <div class="pt-6 pb-4">
       <div class="flex items-center justify-between mb-3">
         <div class="flex items-center gap-3">
           <h2 class="text-[13px] font-semibold tracking-[0.01em]">Hosts</h2>
           <div class="text-xs text-ink-fade">{{$page.ShownCount}} of {{$page.HostCount}}</div>
         </div>
+        <label style="display: inline-flex; align-items: center; gap: 5px; cursor: pointer; font-size: 10px;"
+               class="text-ink-fade" title="auto-refresh every 5s">
+          <input type="checkbox" id="dashboard-live-toggle" checked
+                 onchange="localStorage.setItem('rm-dashboard-live', this.checked ? 'on' : 'off'); document.getElementById('dashboard-live-dot').style.opacity = this.checked ? '1' : '0.3';"
+                 style="width: 11px; height: 11px; cursor: pointer; margin: 0;" />
+          <span>live</span>
+          <span id="dashboard-live-dot" class="text-accent">●</span>
+        </label>
       </div>
 
+      {{/* Filter row (NS-04): GET /, every input is a hidden field
+           for the filters not currently being edited so submit
+           merges rather than clobbers state. */}}
+      <form method="get" action="/" class="flex items-center gap-2 mb-3 text-[11.5px] flex-wrap">
+        <input type="text" name="q" value="{{$f.Search}}" placeholder="search hostname…"
+               class="field mono"
+               style="padding: 6px 10px; font-size: 11.5px; width: 220px;">
+        <select name="status" class="field"
+                style="padding: 5px 8px; font-size: 11.5px; width: auto;"
+                onchange="this.form.submit()">
+          <option value=""           {{if eq $f.Status ""}}selected{{end}}>any status</option>
+          <option value="online"     {{if eq $f.Status "online"}}selected{{end}}>online</option>
+          <option value="offline"    {{if eq $f.Status "offline"}}selected{{end}}>offline</option>
+          <option value="never_seen" {{if eq $f.Status "never_seen"}}selected{{end}}>never seen</option>
+        </select>
+        <select name="repo_status" class="field"
+                style="padding: 5px 8px; font-size: 11.5px; width: auto;"
+                onchange="this.form.submit()">
+          <option value=""            {{if eq $f.RepoStatus ""}}selected{{end}}>any repo state</option>
+          <option value="ready"       {{if eq $f.RepoStatus "ready"}}selected{{end}}>ready</option>
+          <option value="init_failed" {{if eq $f.RepoStatus "init_failed"}}selected{{end}}>init failed</option>
+          <option value="unknown"     {{if eq $f.RepoStatus "unknown"}}selected{{end}}>unknown</option>
+        </select>
+        {{if $f.Tag}}<input type="hidden" name="tag" value="{{$f.Tag}}">{{end}}
+        {{if ne $f.Sort "name"}}<input type="hidden" name="sort" value="{{$f.Sort}}">{{end}}
+        {{if eq $f.Dir "desc"}}<input type="hidden" name="dir" value="desc">{{end}}
+        <button type="submit" class="btn btn-sm">Apply</button>
+        {{if or $f.Search $f.Status $f.RepoStatus}}
+          <a href="/{{if $f.Tag}}?tag={{$f.Tag}}{{end}}" class="text-ink-fade text-[11.5px] mono ml-1">clear</a>
+        {{end}}
+      </form>
+
       {{/* Tag chip-row — only renders when at least one tag exists in
            the fleet. Active tag is highlighted; clicking the active
            tag clears the filter. The "All" pill is shown in the active
            state when no tag filter is set. */}}
       {{if $page.KnownTags}}
         <div class="flex items-center gap-1.5 flex-wrap mb-3 text-[11.5px]">
-          <span class="text-ink-fade mr-1">filter</span>
+          <span class="text-ink-fade mr-1">tag</span>
           <a href="/" class="tag {{if eq $page.ActiveTag ""}}tag-active{{end}}">All</a>
           {{range $page.KnownTags}}
             {{$t := .}}
@@ -144,15 +186,24 @@
         </div>
       {{end}}
 
-      <div class="panel rounded-[7px] overflow-hidden">
+      {{/* Live-poll wrapper (NS-04, mirrors the alerts pattern). hx-get
+           refetches with the current filter pinned; hx-select grabs only
+           this same div from the response so the surrounding chrome
+           doesn't flash. The toggle persists in localStorage so a
+           refreshed tab honours the operator's previous choice. */}}
+      <div id="hosts-table" class="panel rounded-[7px] overflow-hidden"
+           hx-get="{{$page.RefreshURL}}"
+           hx-trigger="every 5s [document.visibilityState==='visible' && localStorage.getItem('rm-dashboard-live')!=='off']"
+           hx-select="#hosts-table"
+           hx-swap="outerHTML">
 
         <div class="host-row head hairline">
           <div></div>
-          <div>Host</div>
-          <div>OS · arch</div>
-          <div>Last backup</div>
-          <div class="text-right">Repo size</div>
-          <div class="text-right">Snapshots</div>
+          <div><a href="{{index $sortURL "name"}}" class="text-ink-mid hover:text-ink">Host{{if eq $f.Sort "name"}} {{if eq $f.Dir "desc"}}↓{{else}}↑{{end}}{{end}}</a></div>
+          <div><a href="{{index $sortURL "os"}}" class="text-ink-mid hover:text-ink">OS · arch{{if eq $f.Sort "os"}} {{if eq $f.Dir "desc"}}↓{{else}}↑{{end}}{{end}}</a></div>
+          <div><a href="{{index $sortURL "last_backup"}}" class="text-ink-mid hover:text-ink">Last backup{{if eq $f.Sort "last_backup"}} {{if eq $f.Dir "desc"}}↓{{else}}↑{{end}}{{end}}</a></div>
+          <div class="text-right"><a href="{{index $sortURL "repo_size"}}" class="text-ink-mid hover:text-ink">Repo size{{if eq $f.Sort "repo_size"}} {{if eq $f.Dir "desc"}}↓{{else}}↑{{end}}{{end}}</a></div>
+          <div class="text-right"><a href="{{index $sortURL "snapshot_count"}}" class="text-ink-mid hover:text-ink">Snapshots{{if eq $f.Sort "snapshot_count"}} {{if eq $f.Dir "desc"}}↓{{else}}↑{{end}}{{end}}</a></div>
           <div>Alerts</div>
           <div>Tags</div>
           <div></div>