P1-22: snapshot listing via restic snapshots --json

Agent calls restic snapshots --json after each successful backup
(60s timeout, separate from the backup ctx) and ships the projection
over the existing snapshots.report WS envelope. Failure here is
logged but doesn't fail the job — the next successful backup catches
the projection up.

Server-side ReplaceHostSnapshots is delete-then-insert plus a
hosts.snapshot_count update in one transaction so the dashboard's
per-host count stays consistent with the projection. New read
endpoint GET /api/hosts/{id}/snapshots returns the cached list with
a refreshed_at marker so the UI can show staleness when an agent
has been offline.

Schema: dropped the unused snapshots.repo_id FK (repos as a
first-class entity is P2 work), added short_id and refreshed_at
columns, switched the time index to DESC for the most-recent-first
list query. api.Snapshot gains short_id; size_bytes/file_count come
from the embedded summary block on restic 0.16+ and stay zero on
older clients.

Tests cover round-trip, authoritative replacement after forget+prune
shrinkage, and empty-after-wipe.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/server/ws/handler.go

@@ -185,8 +185,33 @@ func dispatchAgentMessage(ctx context.Context, c *Conn, hostID string, env api.E
 			slog.Warn("ws: append job log", "job_id", p.JobID, "err", err)
 		}
 
-	case api.MsgSnapshotsRpt, api.MsgRepoStats, api.MsgScheduleAck, api.MsgCommandResult:
-		// TODO(P1-22 + P2): persist these projections.
+	case api.MsgSnapshotsRpt:
+		var p api.SnapshotsReportPayload
+		if err := env.UnmarshalPayload(&p); err != nil {
+			slog.Warn("ws: bad snapshots.report payload", "host_id", hostID, "err", err)
+			break
+		}
+		snaps := make([]store.Snapshot, len(p.Snapshots))
+		for i, s := range p.Snapshots {
+			snaps[i] = store.Snapshot{
+				ID:        s.ID,
+				ShortID:   s.ShortID,
+				Time:      s.Time,
+				Hostname:  s.Hostname,
+				Paths:     s.Paths,
+				Tags:      s.Tags,
+				SizeBytes: s.SizeBytes,
+				FileCount: s.FileCount,
+			}
+		}
+		if err := deps.Store.ReplaceHostSnapshots(ctx, hostID, snaps, time.Now().UTC()); err != nil {
+			slog.Warn("ws: replace snapshots", "host_id", hostID, "err", err)
+		} else {
+			slog.Info("ws: snapshots refreshed", "host_id", hostID, "count", len(snaps))
+		}
+
+	case api.MsgRepoStats, api.MsgScheduleAck, api.MsgCommandResult:
+		// TODO(P2): persist these projections.
 		slog.Debug("ws msg not yet handled", "type", env.Type, "host_id", hostID)
 
 	case api.MsgError: