P2-04.5: kill host.default_paths in favour of manual schedules

Two independent path lists for "what does this host back up?" was
a real divergence footgun — operator types one set at Add-host time
and a different set into a schedule, both end up in the same repo,
the snapshot history looks fine until restore. Resolution: drop
host.default_paths entirely; add a `manual` flag on schedules.
A manual schedule has paths/excludes/tags/retention like any other
but no cron — it fires only via per-schedule Run-now. Single source
of truth for what gets backed up.

Schema (migration 0007):
* schedules.manual INTEGER NOT NULL DEFAULT 0.
* For every host with non-empty default_paths, seed a manual
  schedule with those paths and bump host_schedule_version.
* ALTER TABLE hosts DROP COLUMN default_paths.
* ALTER TABLE enrollment_tokens RENAME COLUMN default_paths
  TO initial_paths.

Original draft of this migration rebuilt hosts via the
create-new + drop-old + rename-new pattern. With foreign_keys=ON
(set in the connection DSN), DROP TABLE on the parent fired
ON DELETE CASCADE on every child of hosts(id) — schedules /
jobs / snapshots / host_credentials all wiped on the smoke env
when I tried it. SQLite 3.35+ supports column-level ALTERs
directly, so we skip the rebuild dance and avoid the cascade
trap. Six lines of SQL instead of sixty, no FK risk.

Run-now rewiring:
* New `dispatchScheduleNow(hostID, scheduleID, conn?)` helper
  unifies the agent-driven path (cron fire → schedule.fire →
  OnScheduleFire callback) and the UI-driven path (operator
  clicks Run-now on a schedule row). Conn arg is optional; nil
  falls back to Hub.Send.
* New POST /hosts/{id}/schedules/{sid}/run endpoint — per-row
  Run-now button on the schedules list.
* Dashboard's per-host Run-now (handleUIRunBackup) now picks the
  host's only enabled manual schedule, falls back to the only
  enabled schedule, else returns "pick one in Schedules tab".
  Keeps one-click for the common case.

Agent:
* Scheduler skips manual schedules in cron build (silent — they're
  a normal data shape, not an error).
* Wire Schedule struct gains Manual flag.
* Schedule.fire flow unchanged — the agent only ever fires
  non-manual schedules anyway.

UI:
* Add-host form retitled "Initial schedule · manual" so the
  operator knows the paths become an editable schedule under
  the Schedules tab. Result page calls out the manual schedule
  + points at Host > Schedules.
* Schedule edit form: "Manual schedule" checkbox at the top of
  the When section; toggling it hides/shows the cron field via
  inline JS. Server-side validator skips the cron requirement
  when manual=true.
* Schedule list shows a "manual" tag under the status pill and
  renders the When column as "— run-now only —" for manual rows.
  Each row gets a Run-now button when the schedule is enabled
  and the host is online.

Tests + go test ./... green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/store/schedules.go

@@ -43,13 +43,13 @@ func (st *Store) CreateSchedule(ctx context.Context, s *Schedule) error {
 	if _, err := tx.ExecContext(ctx,
 		`INSERT INTO schedules (
 			id, host_id, kind, cron_expr, paths, excludes, tags,
-			retention_policy, options, pre_hook, post_hook, enabled,
+			retention_policy, options, pre_hook, post_hook, enabled, manual,
 			created_at, updated_at
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 		s.ID, s.HostID, s.Kind, s.CronExpr,
 		string(pathsJSON), string(excludesJSON), string(tagsJSON),
 		string(retentionJSON), string(optionsJSON),
-		s.PreHook, s.PostHook, boolToInt(s.Enabled),
+		s.PreHook, s.PostHook, boolToInt(s.Enabled), boolToInt(s.Manual),
 		now.Format(time.RFC3339Nano), now.Format(time.RFC3339Nano),
 	); err != nil {
 		return fmt.Errorf("store: create schedule: %w", err)
@@ -94,13 +94,13 @@ func (st *Store) UpdateSchedule(ctx context.Context, s *Schedule) error {
 		`UPDATE schedules SET
 			cron_expr = ?, paths = ?, excludes = ?, tags = ?,
 			retention_policy = ?, options = ?,
-			pre_hook = ?, post_hook = ?, enabled = ?,
+			pre_hook = ?, post_hook = ?, enabled = ?, manual = ?,
 			updated_at = ?
 		 WHERE id = ? AND host_id = ?`,
 		s.CronExpr,
 		string(pathsJSON), string(excludesJSON), string(tagsJSON),
 		string(retentionJSON), string(optionsJSON),
-		s.PreHook, s.PostHook, boolToInt(s.Enabled),
+		s.PreHook, s.PostHook, boolToInt(s.Enabled), boolToInt(s.Manual),
 		now.Format(time.RFC3339Nano),
 		s.ID, s.HostID,
 	)
@@ -148,7 +148,7 @@ func (st *Store) DeleteSchedule(ctx context.Context, hostID, scheduleID string)
 func (st *Store) GetSchedule(ctx context.Context, hostID, scheduleID string) (*Schedule, error) {
 	row := st.db.QueryRowContext(ctx,
 		`SELECT id, host_id, kind, cron_expr, paths, excludes, tags,
-			retention_policy, options, pre_hook, post_hook, enabled,
+			retention_policy, options, pre_hook, post_hook, enabled, manual,
 			created_at, updated_at
 		 FROM schedules WHERE id = ? AND host_id = ?`,
 		scheduleID, hostID)
@@ -164,7 +164,7 @@ func (st *Store) GetSchedule(ctx context.Context, hostID, scheduleID string) (*S
 func (st *Store) ListSchedulesByHost(ctx context.Context, hostID string) ([]Schedule, error) {
 	rows, err := st.db.QueryContext(ctx,
 		`SELECT id, host_id, kind, cron_expr, paths, excludes, tags,
-			retention_policy, options, pre_hook, post_hook, enabled,
+			retention_policy, options, pre_hook, post_hook, enabled, manual,
 			created_at, updated_at
 		 FROM schedules WHERE host_id = ? ORDER BY created_at`,
 		hostID)
@@ -238,11 +238,11 @@ func scanScheduleRow(s scheduleScanner) (*Schedule, error) {
 		out                                          Schedule
 		paths, excludes, tags, retention, options    string
 		createdAt, updatedAt                         string
-		enabled                                      int
+		enabled, manual                              int
 	)
 	err := s.Scan(&out.ID, &out.HostID, &out.Kind, &out.CronExpr,
 		&paths, &excludes, &tags, &retention, &options,
-		&out.PreHook, &out.PostHook, &enabled,
+		&out.PreHook, &out.PostHook, &enabled, &manual,
 		&createdAt, &updatedAt)
 	if err != nil {
 		return nil, err
@@ -263,6 +263,7 @@ func scanScheduleRow(s scheduleScanner) (*Schedule, error) {
 		_ = json.Unmarshal([]byte(options), &out.Options)
 	}
 	out.Enabled = enabled != 0
+	out.Manual = manual != 0
 	if t, err := time.Parse(time.RFC3339Nano, createdAt); err == nil {
 		out.CreatedAt = t
 	}