P2-04.5: kill host.default_paths in favour of manual schedules

Two independent path lists for "what does this host back up?" was
a real divergence footgun — operator types one set at Add-host time
and a different set into a schedule, both end up in the same repo,
the snapshot history looks fine until restore. Resolution: drop
host.default_paths entirely; add a `manual` flag on schedules.
A manual schedule has paths/excludes/tags/retention like any other
but no cron — it fires only via per-schedule Run-now. Single source
of truth for what gets backed up.

Schema (migration 0007):
* schedules.manual INTEGER NOT NULL DEFAULT 0.
* For every host with non-empty default_paths, seed a manual
  schedule with those paths and bump host_schedule_version.
* ALTER TABLE hosts DROP COLUMN default_paths.
* ALTER TABLE enrollment_tokens RENAME COLUMN default_paths
  TO initial_paths.

Original draft of this migration rebuilt hosts via the
create-new + drop-old + rename-new pattern. With foreign_keys=ON
(set in the connection DSN), DROP TABLE on the parent fired
ON DELETE CASCADE on every child of hosts(id) — schedules /
jobs / snapshots / host_credentials all wiped on the smoke env
when I tried it. SQLite 3.35+ supports column-level ALTERs
directly, so we skip the rebuild dance and avoid the cascade
trap. Six lines of SQL instead of sixty, no FK risk.

Run-now rewiring:
* New `dispatchScheduleNow(hostID, scheduleID, conn?)` helper
  unifies the agent-driven path (cron fire → schedule.fire →
  OnScheduleFire callback) and the UI-driven path (operator
  clicks Run-now on a schedule row). Conn arg is optional; nil
  falls back to Hub.Send.
* New POST /hosts/{id}/schedules/{sid}/run endpoint — per-row
  Run-now button on the schedules list.
* Dashboard's per-host Run-now (handleUIRunBackup) now picks the
  host's only enabled manual schedule, falls back to the only
  enabled schedule, else returns "pick one in Schedules tab".
  Keeps one-click for the common case.

Agent:
* Scheduler skips manual schedules in cron build (silent — they're
  a normal data shape, not an error).
* Wire Schedule struct gains Manual flag.
* Schedule.fire flow unchanged — the agent only ever fires
  non-manual schedules anyway.

UI:
* Add-host form retitled "Initial schedule · manual" so the
  operator knows the paths become an editable schedule under
  the Schedules tab. Result page calls out the manual schedule
  + points at Host > Schedules.
* Schedule edit form: "Manual schedule" checkbox at the top of
  the When section; toggling it hides/shows the cron field via
  inline JS. Server-side validator skips the cron requirement
  when manual=true.
* Schedule list shows a "manual" tag under the status pill and
  renders the When column as "— run-now only —" for manual rows.
  Each row gets a Run-now button when the schedule is enabled
  and the host is online.

Tests + go test ./... green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/server/http/enrollment.go

@@ -56,12 +56,11 @@ type enrollOperatorRequest struct {
 	RepoURL      string   `json:"repo_url"`
 	RepoUsername string   `json:"repo_username"`
 	RepoPassword string   `json:"repo_password"`
-	// DefaultPaths lands on the host row at consume time. Used by
-	// run-now buttons (the dashboard's per-row Run, the host
-	// detail's Run backup now). When schedules ship in P2-01 they
-	// supersede this — until then, this is the only source of paths
-	// for run-now jobs.
-	DefaultPaths []string `json:"default_paths,omitempty"`
+	// InitialPaths seeds the host's initial manual schedule on
+	// consume — operator can edit/extend from the host's Schedules
+	// tab afterwards. Empty list = no initial schedule (operator
+	// must add one before backups can run).
+	InitialPaths []string `json:"initial_paths,omitempty"`
 }
 
 type enrollOperatorResponse struct {
@@ -134,7 +133,6 @@ func (s *Server) handleAgentEnroll(w stdhttp.ResponseWriter, r *stdhttp.Request)
 		AgentVersion:  req.AgentVersion,
 		ResticVersion: req.ResticVersion,
 		EnrolledAt:    time.Now().UTC(),
-		DefaultPaths:  attachments.DefaultPaths,
 	}
 	if err := s.deps.Store.CreateHost(r.Context(), host,
 		auth.HashToken(agentToken), ""); err != nil {
@@ -142,6 +140,28 @@ func (s *Server) handleAgentEnroll(w stdhttp.ResponseWriter, r *stdhttp.Request)
 		return
 	}
 
+	// Seed an initial manual schedule from whatever paths the
+	// operator typed into Add-host. The schedule is editable from
+	// the host's Schedules tab; the operator can add automated
+	// schedules alongside it later. We skip this when no paths
+	// were supplied — the host can still enrol; it just can't
+	// back up until the operator adds a schedule.
+	if len(attachments.InitialPaths) > 0 {
+		seed := store.Schedule{
+			ID:       ulid.Make().String(),
+			HostID:   hostID,
+			Kind:     string(api.JobBackup),
+			CronExpr: "",
+			Paths:    attachments.InitialPaths,
+			Enabled:  true,
+			Manual:   true,
+		}
+		if err := s.deps.Store.CreateSchedule(r.Context(), &seed); err != nil {
+			slog.Warn("enrollment: seed manual schedule failed",
+				"host_id", hostID, "err", err)
+		}
+	}
+
 	// Promote the encrypted repo creds onto the freshly-created host
 	// row. If this fails for any reason we log loudly but still
 	// return the bearer — the operator recovers via PUT
@@ -203,7 +223,7 @@ func (s *Server) handleCreateEnrollmentToken(w stdhttp.ResponseWriter, r *stdhtt
 		writeJSONError(w, stdhttp.StatusBadRequest, "invalid_json", err.Error())
 		return
 	}
-	token, expiresAt, err := s.mintEnrollmentToken(r.Context(), req.RepoURL, req.RepoUsername, req.RepoPassword, req.DefaultPaths)
+	token, expiresAt, err := s.mintEnrollmentToken(r.Context(), req.RepoURL, req.RepoUsername, req.RepoPassword, req.InitialPaths)
 	switch err {
 	case nil:
 		writeJSON(w, stdhttp.StatusCreated, enrollOperatorResponse{Token: token, ExpiresAt: expiresAt})
@@ -226,7 +246,7 @@ var errMissingRepoCreds = errAuth("missing_repo_creds")
 // token (shown to the operator exactly once) and the expiry time.
 //
 // Shared by the JSON endpoint and the HTML "Add host" flow.
-func (s *Server) mintEnrollmentToken(ctx context.Context, repoURL, repoUsername, repoPassword string, defaultPaths []string) (string, time.Time, error) {
+func (s *Server) mintEnrollmentToken(ctx context.Context, repoURL, repoUsername, repoPassword string, initialPaths []string) (string, time.Time, error) {
 	if repoURL == "" || repoPassword == "" {
 		return "", time.Time{}, errMissingRepoCreds
 	}
@@ -243,12 +263,12 @@ func (s *Server) mintEnrollmentToken(ctx context.Context, repoURL, repoUsername,
 		return "", time.Time{}, err
 	}
 
-	if defaultPaths == nil {
-		defaultPaths = []string{}
+	if initialPaths == nil {
+		initialPaths = []string{}
 	}
-	pathsJSON, err := json.Marshal(defaultPaths)
+	pathsJSON, err := json.Marshal(initialPaths)
 	if err != nil {
-		return "", time.Time{}, fmt.Errorf("marshal default_paths: %w", err)
+		return "", time.Time{}, fmt.Errorf("marshal initial_paths: %w", err)
 	}
 
 	const ttl = time.Hour