P2-04.5: kill host.default_paths in favour of manual schedules

Two independent path lists for "what does this host back up?" was
a real divergence footgun — operator types one set at Add-host time
and a different set into a schedule, both end up in the same repo,
the snapshot history looks fine until restore. Resolution: drop
host.default_paths entirely; add a `manual` flag on schedules.
A manual schedule has paths/excludes/tags/retention like any other
but no cron — it fires only via per-schedule Run-now. Single source
of truth for what gets backed up.

Schema (migration 0007):
* schedules.manual INTEGER NOT NULL DEFAULT 0.
* For every host with non-empty default_paths, seed a manual
  schedule with those paths and bump host_schedule_version.
* ALTER TABLE hosts DROP COLUMN default_paths.
* ALTER TABLE enrollment_tokens RENAME COLUMN default_paths
  TO initial_paths.

Original draft of this migration rebuilt hosts via the
create-new + drop-old + rename-new pattern. With foreign_keys=ON
(set in the connection DSN), DROP TABLE on the parent fired
ON DELETE CASCADE on every child of hosts(id) — schedules /
jobs / snapshots / host_credentials all wiped on the smoke env
when I tried it. SQLite 3.35+ supports column-level ALTERs
directly, so we skip the rebuild dance and avoid the cascade
trap. Six lines of SQL instead of sixty, no FK risk.

Run-now rewiring:
* New `dispatchScheduleNow(hostID, scheduleID, conn?)` helper
  unifies the agent-driven path (cron fire → schedule.fire →
  OnScheduleFire callback) and the UI-driven path (operator
  clicks Run-now on a schedule row). Conn arg is optional; nil
  falls back to Hub.Send.
* New POST /hosts/{id}/schedules/{sid}/run endpoint — per-row
  Run-now button on the schedules list.
* Dashboard's per-host Run-now (handleUIRunBackup) now picks the
  host's only enabled manual schedule, falls back to the only
  enabled schedule, else returns "pick one in Schedules tab".
  Keeps one-click for the common case.

Agent:
* Scheduler skips manual schedules in cron build (silent — they're
  a normal data shape, not an error).
* Wire Schedule struct gains Manual flag.
* Schedule.fire flow unchanged — the agent only ever fires
  non-manual schedules anyway.

UI:
* Add-host form retitled "Initial schedule · manual" so the
  operator knows the paths become an editable schedule under
  the Schedules tab. Result page calls out the manual schedule
  + points at Host > Schedules.
* Schedule edit form: "Manual schedule" checkbox at the top of
  the When section; toggling it hides/shows the cron field via
  inline JS. Server-side validator skips the cron requirement
  when manual=true.
* Schedule list shows a "manual" tag under the status pill and
  renders the When column as "— run-now only —" for manual rows.
  Each row gets a Run-now button when the schedule is enabled
  and the host is online.

Tests + go test ./... green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/store/enrollment.go

@@ -19,26 +19,25 @@ import (
 // later via PUT /api/hosts/{id}/repo-credentials; the agent will
 // refuse backup jobs until that lands.
 //
-// defaultPaths is the JSON-encoded path list (the agent invokes
-// `restic backup` with these on a run-now without explicit paths).
-// Empty string is treated as "[]". Not encrypted — paths aren't
-// secret.
-func (s *Store) CreateEnrollmentToken(ctx context.Context, tokenHash string, ttl time.Duration, encRepoCreds, defaultPaths string) error {
+// initialPaths is the JSON-encoded path list seeded into the host's
+// initial manual schedule on consume. Empty string is treated as
+// "[]". Not encrypted — paths aren't secret.
+func (s *Store) CreateEnrollmentToken(ctx context.Context, tokenHash string, ttl time.Duration, encRepoCreds, initialPaths string) error {
 	now := time.Now().UTC()
 	var enc any = nil
 	if encRepoCreds != "" {
 		enc = encRepoCreds
 	}
-	if defaultPaths == "" {
-		defaultPaths = "[]"
+	if initialPaths == "" {
+		initialPaths = "[]"
 	}
 	_, err := s.db.ExecContext(ctx,
-		`INSERT INTO enrollment_tokens (token_hash, created_at, expires_at, enc_repo_creds, default_paths)
+		`INSERT INTO enrollment_tokens (token_hash, created_at, expires_at, enc_repo_creds, initial_paths)
 		 VALUES (?, ?, ?, ?, ?)`,
 		tokenHash,
 		now.Format(time.RFC3339Nano),
 		now.Add(ttl).Format(time.RFC3339Nano),
-		enc, defaultPaths)
+		enc, initialPaths)
 	if err != nil {
 		return fmt.Errorf("store: create enrollment token: %w", err)
 	}
@@ -77,9 +76,10 @@ type EnrollmentTokenAttachments struct {
 	// EncRepoCreds is the AEAD ciphertext bound (additional-data) to
 	// "token:" + token_hash. Empty if no creds were stashed.
 	EncRepoCreds string
-	// DefaultPaths is the operator's run-now path list. Always
-	// non-nil (empty slice if none were set).
-	DefaultPaths []string
+	// InitialPaths is the operator-supplied path list seeded into
+	// the host's initial manual schedule. Always non-nil (empty
+	// slice if none were set).
+	InitialPaths []string
 }
 
 // GetEnrollmentTokenAttachments returns the operator-supplied
@@ -93,25 +93,25 @@ type EnrollmentTokenAttachments struct {
 func (s *Store) GetEnrollmentTokenAttachments(ctx context.Context, tokenHash string) (EnrollmentTokenAttachments, error) {
 	now := time.Now().UTC().Format(time.RFC3339Nano)
 	row := s.db.QueryRowContext(ctx,
-		`SELECT enc_repo_creds, default_paths FROM enrollment_tokens
+		`SELECT enc_repo_creds, initial_paths FROM enrollment_tokens
 		 WHERE token_hash = ? AND consumed_at IS NULL AND expires_at > ?`,
 		tokenHash, now)
 	var (
 		enc          sql.NullString
-		defaultPaths string
+		initialPaths string
 	)
-	if err := row.Scan(&enc, &defaultPaths); err != nil {
+	if err := row.Scan(&enc, &initialPaths); err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
 			return EnrollmentTokenAttachments{}, ErrNotFound
 		}
 		return EnrollmentTokenAttachments{}, fmt.Errorf("store: get enrollment token attachments: %w", err)
 	}
-	out := EnrollmentTokenAttachments{DefaultPaths: []string{}}
+	out := EnrollmentTokenAttachments{InitialPaths: []string{}}
 	if enc.Valid {
 		out.EncRepoCreds = enc.String
 	}
-	if defaultPaths != "" {
-		_ = json.Unmarshal([]byte(defaultPaths), &out.DefaultPaths)
+	if initialPaths != "" {
+		_ = json.Unmarshal([]byte(initialPaths), &out.InitialPaths)
 	}
 	return out, nil
 }