P1-32: server-side encrypted repo creds + push-on-hello

Operator-minted enrollment tokens now carry the repo URL/username/
password as one AEAD blob bound (via additional-data) to the token
hash. ConsumeEnrollmentToken re-encrypts under host_id and writes a
host_credentials row in the same tx as token-burn, so the binding
moves with the credential.

PUT /api/hosts/{id}/repo-credentials lets an operator edit creds
post-enrollment; merges with the existing blob, audits, and pushes
config.update if the agent is connected.

WS handler grows an OnHello hook that the HTTP layer wires to send
the host's decrypted creds as a config.update immediately after the
hello succeeds — synchronously, so a racing command.run lands after
the agent has its repo password.

Schema: 0002_host_credentials.sql adds enc_repo_creds to
enrollment_tokens and a host_credentials table (PK = host_id, FK
ON DELETE CASCADE).

Tests: round-trip token → consume → host_credentials with AAD swap
detection; no-creds path stays compatible.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/server/http/server.go

@@ -89,13 +89,18 @@ func (s *Server) routes(r chi.Router) {
 
 		// Snapshot projection (refreshed by the agent after each backup).
 		r.Get("/hosts/{id}/snapshots", s.handleListHostSnapshots)
+
+		// Repo credentials — operator can edit after enrollment. The
+		// initial set is supplied at token-mint time (see enrollment.go).
+		r.Put("/hosts/{id}/repo-credentials", s.handleSetHostCredentials)
 	})
 
 	// Agent ↔ server WebSocket. Bearer-authenticated inside the handler.
 	if s.deps.Hub != nil {
 		r.Mount("/ws/agent", ws.AgentHandler(ws.HandlerDeps{
-			Hub:   s.deps.Hub,
-			Store: s.deps.Store,
+			Hub:     s.deps.Hub,
+			Store:   s.deps.Store,
+			OnHello: s.onAgentHello,
 		}))
 	}