agent: log accept/complete on backup jobs; audit: populate host.enrolled payload

Two warts surfaced during the smoke run:

- Agent was silent between "config.update applied" and "job
  finished" — operators tailing journalctl saw no acknowledgement
  that a command.run had landed. Adds Info logs at job-accept
  ({job_id, paths}) and at successful completion.

- The host.enrolled audit row had an empty {} payload. Now
  carries {hostname, os, arch, has_repo_creds} so an audit-log
  reader can answer "what got enrolled and did the operator
  bundle creds with the token" without joining back to hosts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cmd/agent/main.go

@@ -250,10 +250,14 @@ func (d *dispatcher) runJob(ctx context.Context, p api.CommandRunPayload, tx wsc
 	case api.JobBackup:
 		// Agent.Args carries [paths...]. Excludes/tags are not yet
 		// surfaced over the wire; they come with P2 schedule support.
+		slog.Info("agent: accepting backup job",
+			"job_id", p.JobID, "paths", p.Args)
 		go func() {
 			if err := r.RunBackup(ctx, p.JobID, p.Args, nil, nil); err != nil {
 				slog.Warn("agent: backup job failed", "job_id", p.JobID, "err", err)
+				return
 			}
+			slog.Info("agent: backup job complete", "job_id", p.JobID)
 		}()
 	default:
 		return fmt.Errorf("kind %q not implemented yet (Phase 2 lands the rest)", p.Kind)