ui: P2R-12 hook editor — source-group form + host-default Repo section

Source-group edit form gains pre/post hook textareas with a service-
user warning banner; bodies AEAD-encrypted on save (per-group AD).
Repo page adds a 'Host-default hooks' panel above the danger zone
with the same shape; saved via POST /hosts/{id}/repo/hooks.

internal/server/http/ui_repo.go

@@ -79,11 +79,16 @@ type hostRepoPage struct {
 	UntaggedSnapshots int
 	GroupNames        []string // ordered, for stable rendering
 
+	// Host-default hooks (decrypted plaintext for round-trip in form).
+	HostPreHook  string
+	HostPostHook string
+
 	// Inline form-error banners. Empty when no error for that section.
 	CredentialsError string
 	AdminCredsError  string
 	BandwidthError   string
 	MaintenanceError string
+	HooksError       string
 
 	// Highlight which form was just submitted, for the success-state
 	// border (subtle UX nicety; empty = no recent save).
@@ -179,6 +184,10 @@ func (s *Server) loadHostRepoPage(r *stdhttp.Request, host store.Host) (*hostRep
 		p.BandwidthDown = strconv.Itoa(*host.BandwidthDownKBps)
 	}
 
+	// Host-default hooks (decrypt for round-trip in the form).
+	p.HostPreHook = s.decryptHookOrFallback("", host.PreHookDefault, host.ID, "pre")
+	p.HostPostHook = s.decryptHookOrFallback("", host.PostHookDefault, host.ID, "post")
+
 	// Maintenance — auto-seed defaults if missing.
 	m, err := s.deps.Store.GetRepoMaintenance(r.Context(), host.ID)
 	if err != nil && errors.Is(err, store.ErrNotFound) {