P1 polish: Host.default_paths interim + restic env hygiene + job_id JS quoting

Two fixes that close the loop on dashboard run-now and harden the
agent's restic invocation.

Default paths (interim until P2-01 schedules):
  - 0003 migration adds default_paths TEXT NOT NULL DEFAULT '[]'
    to hosts and to enrollment_tokens.
  - Operator types paths in the Add-host form (textarea, one per
    line). They ride on the enrol_token row alongside the
    encrypted creds (paths aren't secret — plain JSON column).
  - On consume, ConsumeEnrollmentToken still just burns the token;
    the new GetEnrollmentTokenAttachments returns both the
    re-bindable creds and the path list in one round trip, the
    handler transfers them onto the new host row inside CreateHost.
  - The dashboard's Run-now and host-detail's "Run backup now"
    button now read Host.DefaultPaths and pass them to dispatchJob.
    A host with no default paths returns 400 with a friendly
    "no paths set" message instead of dispatching a doomed
    `restic backup` with no positional args.
  - Doc comments explicitly call this out as a Phase 1 interim —
    schedules supersede.

Restic env hygiene:
  - envSlice() previously omitted HOME / XDG_CACHE_HOME, which
    bit the smoke runs whenever the agent was launched outside
    systemd (restic refused to start: "neither $XDG_CACHE_HOME
    nor $HOME are defined"). Now both are set explicitly: prefer
    Env.ExtraEnv overrides, fall back to the agent process's own
    HOME, and finally to /var/lib/restic-manager.
  - Comment makes the env policy explicit: parent's RESTIC_* /
    AWS_* / B2_* env is filtered out by design — control-plane
    is the unambiguous source of truth.

JS bug fix in the live log page:
  - {{$job.ID | printf "%q"}} produced a literal-quoted JS string,
    which then went into the WS URL as ".../jobs/"<ID>"/stream"
    → 404. Switched to '{{$job.ID}}' inside the literal so
    html/template's auto-escape does the right thing. Verified
    end-to-end: dashboard "Run now" → live progress + log lines
    arrive over the WS → succeeded pill renders.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/restic/runner.go

@@ -10,6 +10,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"os"
 	"os/exec"
 	"strings"
 	"time"
@@ -140,14 +141,41 @@ func (e Env) RunBackup(ctx context.Context, paths, excludes, tags []string, hand
 }
 
 // envSlice converts Env's typed fields into the os/exec env shape.
+//
+// Deliberately does NOT inherit the parent process's environment:
+// any RESTIC_* / AWS_* / B2_* vars in the operator's shell or the
+// systemd unit's Environment= clause are filtered out so the
+// control-plane is the unambiguous source of truth.
+//
+// HOME / XDG_CACHE_HOME are set explicitly because restic insists
+// on one or the other for its cache dir; without it the command
+// fails before ever talking to the repo.
 func (e Env) envSlice() []string {
+	home := "/var/lib/restic-manager"
+	if h, ok := e.ExtraEnv["HOME"]; ok && h != "" {
+		home = h
+	} else if h := os.Getenv("HOME"); h != "" {
+		home = h
+	}
+	xdg := home + "/.cache"
+	if x, ok := e.ExtraEnv["XDG_CACHE_HOME"]; ok && x != "" {
+		xdg = x
+	} else if x := os.Getenv("XDG_CACHE_HOME"); x != "" {
+		xdg = x
+	}
 	out := []string{
 		"RESTIC_REPOSITORY=" + e.RepoURL,
 		"RESTIC_PASSWORD=" + e.RepoPassword,
 		// Feed restic via env-only — keeps creds off ps(1).
 		"PATH=/usr/local/bin:/usr/bin:/bin",
+		"HOME=" + home,
+		"XDG_CACHE_HOME=" + xdg,
 	}
 	for k, v := range e.ExtraEnv {
+		// HOME / XDG_CACHE_HOME already merged in above.
+		if k == "HOME" || k == "XDG_CACHE_HOME" {
+			continue
+		}
 		out = append(out, k+"="+v)
 	}
 	return out