P2-04.5: kill host.default_paths in favour of manual schedules

Two independent path lists for "what does this host back up?" was
a real divergence footgun — operator types one set at Add-host time
and a different set into a schedule, both end up in the same repo,
the snapshot history looks fine until restore. Resolution: drop
host.default_paths entirely; add a `manual` flag on schedules.
A manual schedule has paths/excludes/tags/retention like any other
but no cron — it fires only via per-schedule Run-now. Single source
of truth for what gets backed up.

Schema (migration 0007):
* schedules.manual INTEGER NOT NULL DEFAULT 0.
* For every host with non-empty default_paths, seed a manual
  schedule with those paths and bump host_schedule_version.
* ALTER TABLE hosts DROP COLUMN default_paths.
* ALTER TABLE enrollment_tokens RENAME COLUMN default_paths
  TO initial_paths.

Original draft of this migration rebuilt hosts via the
create-new + drop-old + rename-new pattern. With foreign_keys=ON
(set in the connection DSN), DROP TABLE on the parent fired
ON DELETE CASCADE on every child of hosts(id) — schedules /
jobs / snapshots / host_credentials all wiped on the smoke env
when I tried it. SQLite 3.35+ supports column-level ALTERs
directly, so we skip the rebuild dance and avoid the cascade
trap. Six lines of SQL instead of sixty, no FK risk.

Run-now rewiring:
* New `dispatchScheduleNow(hostID, scheduleID, conn?)` helper
  unifies the agent-driven path (cron fire → schedule.fire →
  OnScheduleFire callback) and the UI-driven path (operator
  clicks Run-now on a schedule row). Conn arg is optional; nil
  falls back to Hub.Send.
* New POST /hosts/{id}/schedules/{sid}/run endpoint — per-row
  Run-now button on the schedules list.
* Dashboard's per-host Run-now (handleUIRunBackup) now picks the
  host's only enabled manual schedule, falls back to the only
  enabled schedule, else returns "pick one in Schedules tab".
  Keeps one-click for the common case.

Agent:
* Scheduler skips manual schedules in cron build (silent — they're
  a normal data shape, not an error).
* Wire Schedule struct gains Manual flag.
* Schedule.fire flow unchanged — the agent only ever fires
  non-manual schedules anyway.

UI:
* Add-host form retitled "Initial schedule · manual" so the
  operator knows the paths become an editable schedule under
  the Schedules tab. Result page calls out the manual schedule
  + points at Host > Schedules.
* Schedule edit form: "Manual schedule" checkbox at the top of
  the When section; toggling it hides/shows the cron field via
  inline JS. Server-side validator skips the cron requirement
  when manual=true.
* Schedule list shows a "manual" tag under the status pill and
  renders the When column as "— run-now only —" for manual rows.
  Each row gets a Run-now button when the schedule is enabled
  and the host is online.

Tests + go test ./... green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/server/http/ui_schedules.go

@@ -26,9 +26,9 @@ type schedulesListPage struct {
 
 // scheduleEditPage drives both the Create form (Schedule.ID empty)
 // and the Edit form (Schedule populated). Errors come back via Error
-// to be rendered as a banner; FormValues holds the just-submitted
-// raw fields so a failed POST can re-render with the operator's
-// typed input still in place.
+// to be rendered as a banner; the rest of the fields hold the just-
+// submitted raw values so a failed POST can re-render with the
+// operator's typed input still in place.
 type scheduleEditPage struct {
 	Host          store.Host
 	IsNew         bool
@@ -49,6 +49,7 @@ type scheduleEditPage struct {
 	LimitUpKBps   string
 	LimitDownKBps string
 	Enabled       bool
+	Manual        bool
 }
 
 // handleUISchedulesList renders the Schedules sub-tab on a host.
@@ -151,6 +152,7 @@ func (s *Server) handleUIScheduleEditGet(w stdhttp.ResponseWriter, r *stdhttp.Re
 		ExcludesRaw: strings.Join(sched.Excludes, "\n"),
 		TagsRaw:     strings.Join(sched.Tags, ", "),
 		Enabled:     sched.Enabled,
+		Manual:      sched.Manual,
 	}
 	page.KeepLast = intStringPtr(sched.RetentionPolicy.KeepLast)
 	page.KeepHourly = intStringPtr(sched.RetentionPolicy.KeepHourly)
@@ -213,6 +215,7 @@ func (s *Server) handleUIScheduleSave(w stdhttp.ResponseWriter, r *stdhttp.Reque
 		LimitUpKBps:   strings.TrimSpace(r.PostForm.Get("limit_up_kbps")),
 		LimitDownKBps: strings.TrimSpace(r.PostForm.Get("limit_down_kbps")),
 		Enabled:       r.PostForm.Get("enabled") == "on",
+		Manual:        r.PostForm.Get("manual") == "on",
 	}
 
 	// Convert the raw form values into store-shape data, surfacing
@@ -234,13 +237,14 @@ func (s *Server) handleUIScheduleSave(w stdhttp.ResponseWriter, r *stdhttp.Reque
 		return
 	}
 
-	// Validate against the same rules the JSON API uses (cron, paths,
-	// hooks-on-non-backup) — the UI only handles backup kind today,
-	// so we hardcode kind=backup here.
+	// Validate against the same rules the JSON API uses. Manual
+	// schedules skip the cron-expr requirement; everything else
+	// applies the same.
 	apiShape := scheduleAPI{
 		Kind:     api.JobBackup,
 		CronExpr: page.CronExpr,
 		Paths:    paths,
+		Manual:   page.Manual,
 	}
 	if code, msg := validateSchedule(&apiShape); code != "" {
 		page.Error = uiErrorMessage(code, msg)
@@ -260,6 +264,7 @@ func (s *Server) handleUIScheduleSave(w stdhttp.ResponseWriter, r *stdhttp.Reque
 			RetentionPolicy: retention,
 			Options:         options,
 			Enabled:         page.Enabled,
+			Manual:          page.Manual,
 		}
 		if err := s.deps.Store.CreateSchedule(r.Context(), &row); err != nil {
 			page.Error = "Couldn't save schedule — see server log."
@@ -294,6 +299,7 @@ func (s *Server) handleUIScheduleSave(w stdhttp.ResponseWriter, r *stdhttp.Reque
 		existing.RetentionPolicy = retention
 		existing.Options = options
 		existing.Enabled = page.Enabled
+		existing.Manual = page.Manual
 		if err := s.deps.Store.UpdateSchedule(r.Context(), existing); err != nil {
 			page.Error = "Couldn't save schedule — see server log."
 			slog.Error("ui schedule update", "err", err)
@@ -315,6 +321,46 @@ func (s *Server) handleUIScheduleSave(w stdhttp.ResponseWriter, r *stdhttp.Reque
 	stdhttp.Redirect(w, r, "/hosts/"+hostID+"/schedules", stdhttp.StatusSeeOther)
 }
 
+// handleUIScheduleRun is the POST target of per-schedule Run-now
+// buttons. Reuses dispatchScheduledJob (the same code path used by
+// the agent's local cron firing) so manual + automated runs flow
+// through identical job lifecycle. Sets HX-Redirect to the live
+// log on success.
+func (s *Server) handleUIScheduleRun(w stdhttp.ResponseWriter, r *stdhttp.Request) {
+	u := s.requireUIUser(w, r)
+	if u == nil {
+		return
+	}
+	hostID := chi.URLParam(r, "id")
+	scheduleID := chi.URLParam(r, "sid")
+	host, err := s.deps.Store.GetHost(r.Context(), hostID)
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			stdhttp.NotFound(w, r)
+			return
+		}
+		stdhttp.Error(w, "internal", stdhttp.StatusInternalServerError)
+		return
+	}
+	if !s.deps.Hub.Connected(hostID) {
+		stdhttp.Error(w, "agent is offline", stdhttp.StatusBadRequest)
+		return
+	}
+	_ = host
+	jobID, err := s.dispatchScheduleNow(r.Context(), hostID, scheduleID, nil)
+	if err != nil {
+		stdhttp.Error(w, err.Error(), stdhttp.StatusBadRequest)
+		return
+	}
+	target := "/jobs/" + jobID
+	if r.Header.Get("HX-Request") == "true" {
+		w.Header().Set("HX-Redirect", target)
+		w.WriteHeader(stdhttp.StatusOK)
+		return
+	}
+	stdhttp.Redirect(w, r, target, stdhttp.StatusSeeOther)
+}
+
 // handleUIScheduleDelete is the POST target of the Delete buttons on
 // the list view. Confirm-then-redirect; no AJAX.
 func (s *Server) handleUIScheduleDelete(w stdhttp.ResponseWriter, r *stdhttp.Request) {