ui: P2R-12 hook editor — source-group form + host-default Repo section

Source-group edit form gains pre/post hook textareas with a service-
user warning banner; bodies AEAD-encrypted on save (per-group AD).
Repo page adds a 'Host-default hooks' panel above the danger zone
with the same shape; saved via POST /hosts/{id}/repo/hooks.

internal/server/http/server.go

@@ -229,6 +229,7 @@ func (s *Server) routes(r chi.Router) {
 		r.Post("/hosts/{id}/repo/bandwidth", s.handleUIRepoBandwidthSave)
 		r.Post("/hosts/{id}/repo/maintenance", s.handleUIRepoMaintenanceSave)
 		r.Post("/hosts/{id}/repo/reinit", s.handleUIRepoReinit)
+		r.Post("/hosts/{id}/repo/hooks", s.handleUIRepoHooksSave)
 		// Admin credentials form (separate slot for prune-capable user).
 		r.Post("/hosts/{id}/admin-credentials", s.handleUIAdminCredentialsSave)
 		r.Post("/hosts/{id}/admin-credentials/delete", s.handleUIAdminCredentialsDelete)