P2-04.5: kill host.default_paths in favour of manual schedules

Two independent path lists for "what does this host back up?" was
a real divergence footgun — operator types one set at Add-host time
and a different set into a schedule, both end up in the same repo,
the snapshot history looks fine until restore. Resolution: drop
host.default_paths entirely; add a `manual` flag on schedules.
A manual schedule has paths/excludes/tags/retention like any other
but no cron — it fires only via per-schedule Run-now. Single source
of truth for what gets backed up.

Schema (migration 0007):
* schedules.manual INTEGER NOT NULL DEFAULT 0.
* For every host with non-empty default_paths, seed a manual
  schedule with those paths and bump host_schedule_version.
* ALTER TABLE hosts DROP COLUMN default_paths.
* ALTER TABLE enrollment_tokens RENAME COLUMN default_paths
  TO initial_paths.

Original draft of this migration rebuilt hosts via the
create-new + drop-old + rename-new pattern. With foreign_keys=ON
(set in the connection DSN), DROP TABLE on the parent fired
ON DELETE CASCADE on every child of hosts(id) — schedules /
jobs / snapshots / host_credentials all wiped on the smoke env
when I tried it. SQLite 3.35+ supports column-level ALTERs
directly, so we skip the rebuild dance and avoid the cascade
trap. Six lines of SQL instead of sixty, no FK risk.

Run-now rewiring:
* New `dispatchScheduleNow(hostID, scheduleID, conn?)` helper
  unifies the agent-driven path (cron fire → schedule.fire →
  OnScheduleFire callback) and the UI-driven path (operator
  clicks Run-now on a schedule row). Conn arg is optional; nil
  falls back to Hub.Send.
* New POST /hosts/{id}/schedules/{sid}/run endpoint — per-row
  Run-now button on the schedules list.
* Dashboard's per-host Run-now (handleUIRunBackup) now picks the
  host's only enabled manual schedule, falls back to the only
  enabled schedule, else returns "pick one in Schedules tab".
  Keeps one-click for the common case.

Agent:
* Scheduler skips manual schedules in cron build (silent — they're
  a normal data shape, not an error).
* Wire Schedule struct gains Manual flag.
* Schedule.fire flow unchanged — the agent only ever fires
  non-manual schedules anyway.

UI:
* Add-host form retitled "Initial schedule · manual" so the
  operator knows the paths become an editable schedule under
  the Schedules tab. Result page calls out the manual schedule
  + points at Host > Schedules.
* Schedule edit form: "Manual schedule" checkbox at the top of
  the When section; toggling it hides/shows the cron field via
  inline JS. Server-side validator skips the cron requirement
  when manual=true.
* Schedule list shows a "manual" tag under the status pill and
  renders the When column as "— run-now only —" for manual rows.
  Each row gets a Run-now button when the schedule is enabled
  and the host is online.

Tests + go test ./... green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/server/http/ui_handlers.go

@@ -1,6 +1,7 @@
 package http
 
 import (
+	"context"
 	"crypto/rand"
 	"encoding/base64"
 	"errors"
@@ -170,23 +171,18 @@ func (s *Server) handleUIRunBackup(w stdhttp.ResponseWriter, r *stdhttp.Request)
 		stdhttp.Error(w, "internal", stdhttp.StatusInternalServerError)
 		return
 	}
-	if len(host.DefaultPaths) == 0 {
-		// Tell the user with HX-Redirect via a friendly toast — for
-		// now, just an HTTP error: HTMX surfaces the response body
-		// to the operator's console, and a future toast component
-		// will lift it into the UI.
-		stdhttp.Error(w,
-			"this host has no default backup paths set — edit the host or wait for schedules (P2)",
-			stdhttp.StatusBadRequest)
-		return
-	}
 	if host.RepoInitialisedAt == nil {
 		stdhttp.Error(w,
 			"this host's repo hasn't been initialised yet — click Initialise repo first",
 			stdhttp.StatusBadRequest)
 		return
 	}
-	res, status, code, msg := s.dispatchJob(r.Context(), storeUser, hostID, api.JobBackup, host.DefaultPaths)
+	pick, err := s.pickRunNowSchedule(r.Context(), hostID)
+	if err != nil {
+		stdhttp.Error(w, err.Error(), stdhttp.StatusBadRequest)
+		return
+	}
+	res, status, code, msg := s.dispatchJob(r.Context(), storeUser, hostID, api.JobBackup, pick.Paths)
 	if code != "" {
 		stdhttp.Error(w, msg, status)
 		return
@@ -205,6 +201,48 @@ func (s *Server) handleUIRunBackup(w stdhttp.ResponseWriter, r *stdhttp.Request)
 	stdhttp.Redirect(w, r, target, stdhttp.StatusSeeOther)
 }
 
+// pickRunNowSchedule chooses which schedule a generic per-host
+// "Run now" button should dispatch when the operator hasn't picked
+// one explicitly. Picks in priority order: the host's only enabled
+// manual schedule, then its only enabled schedule of any kind.
+// Returns a friendly error if there's nothing to run, or if the
+// operator needs to disambiguate.
+func (s *Server) pickRunNowSchedule(ctx context.Context, hostID string) (*store.Schedule, error) {
+	rows, err := s.deps.Store.ListSchedulesByHost(ctx, hostID)
+	if err != nil {
+		return nil, errFmt("internal: %s", err)
+	}
+	enabled := make([]store.Schedule, 0, len(rows))
+	for _, r := range rows {
+		if r.Enabled {
+			enabled = append(enabled, r)
+		}
+	}
+	if len(enabled) == 0 {
+		return nil, errFmt("this host has no enabled schedules — add one in the Schedules tab")
+	}
+	manuals := []store.Schedule{}
+	for _, r := range enabled {
+		if r.Manual {
+			manuals = append(manuals, r)
+		}
+	}
+	switch {
+	case len(manuals) == 1:
+		s := manuals[0]
+		return &s, nil
+	case len(enabled) == 1:
+		s := enabled[0]
+		return &s, nil
+	default:
+		return nil, errFmt("this host has %d schedules — pick one from the Schedules tab", len(enabled))
+	}
+}
+
+func errFmt(format string, args ...any) error {
+	return errFmtf(format, args...)
+}
+
 // handleUIInitRepo dispatches a one-shot `restic init` job for a
 // host. Surfaced in the run-now panel as a red "Initialise repo"
 // button when host.repo_initialised_at IS NULL. On success it