server: maintenance ticker drives forget/prune/check on cadence

Wires a 60s server-side ticker to the pure-logic maintenance.Decide
introduced in the previous commit. Decisions flow through a new
DispatchMaintenance method on *Server, which:

  - skips offline hosts (no pending_runs queueing — maintenance is
    not a backup, missed fires shouldn't pile up)
  - silently skips prune when admin creds aren't bound
  - pushes admin creds before prune, then dispatches with
    RequiresAdminCreds=true (same as operator-driven prune)
  - persists job rows with actor_kind="system"

Reshapes the forget wire payload from a single RetentionPolicy to a
ForgetGroups list (one tag + per-group keep-* per source group). The
agent walks the groups and runs `restic forget --tag <name> --keep-*`
once per group. Dead-code removed: CommandRunPayload.RetentionPolicy,
the old forget JSON-decode in cmd/agent, and the single-policy form of
restic.RunForget.

internal/api/messages.go

@@ -77,6 +77,30 @@ const (
 	JobCancelled JobStatus = "cancelled" //nolint:misspell // wire format
 )
 
+// ForgetPolicyJSON is the wire shape of a per-group retention policy
+// shipped with a forget command.run. Mirrors store.RetentionPolicy
+// JSON tags exactly so a future caller could json-roundtrip between
+// the two without reshaping. All fields nullable; an empty struct is
+// rejected by the agent (restic refuses to forget without --keep-*).
+type ForgetPolicyJSON struct {
+	KeepLast    *int `json:"keep_last,omitempty"`
+	KeepHourly  *int `json:"keep_hourly,omitempty"`
+	KeepDaily   *int `json:"keep_daily,omitempty"`
+	KeepWeekly  *int `json:"keep_weekly,omitempty"`
+	KeepMonthly *int `json:"keep_monthly,omitempty"`
+	KeepYearly  *int `json:"keep_yearly,omitempty"`
+}
+
+// ForgetGroup is one (tag, retention) pair shipped to the agent in a
+// forget command.run. The agent invokes
+// `restic forget --tag <Tag> --keep-* …` once per group, with each
+// group's own policy. The Tag is the source-group name (which is
+// also the snapshot tag carried at backup time).
+type ForgetGroup struct {
+	Tag    string           `json:"tag"`
+	Policy ForgetPolicyJSON `json:"policy"`
+}
+
 // CommandRunPayload is the server → agent dispatch for a run-now job.
 //
 // For kind=backup, Includes/Excludes/Tag are populated from the source
@@ -85,25 +109,27 @@ const (
 // the source group's name) so retention can target it later via
 // `restic forget --tag`.
 //
-// For kind=forget, RetentionPolicy is the typed keep-* set as raw JSON
-// (the agent doesn't share the store package's typed struct).
+// For kind=forget, ForgetGroups carries one entry per source-group on
+// the host that has a non-empty retention policy. The agent walks the
+// list and runs `restic forget --tag <Tag> --keep-* …` per group.
 //
 // Args is preserved as a generic free-form slice for kinds that don't
-// fit the structured fields (e.g. unlock takes none; init takes none).
+// fit the structured fields (e.g. unlock takes none; init takes none;
+// check carries the subset% as Args[0]).
 //
 // RequiresAdminCreds tells the agent to load the admin slot of its
 // secrets store rather than the everyday repo slot. Set by the server
-// only for prune and operator-triggered unlock (kinds that need delete
-// authority on a rest-server repo).
+// only for prune (the only kind that needs delete authority on a
+// rest-server repo today).
 type CommandRunPayload struct {
-	JobID              string          `json:"job_id"`
-	Kind               JobKind         `json:"kind"`
-	Args               []string        `json:"args,omitempty"`
-	Includes           []string        `json:"includes,omitempty"`
-	Excludes           []string        `json:"excludes,omitempty"`
-	Tag                string          `json:"tag,omitempty"`
-	RetentionPolicy    json.RawMessage `json:"retention_policy,omitempty"`
-	RequiresAdminCreds bool            `json:"requires_admin_creds,omitempty"`
+	JobID              string        `json:"job_id"`
+	Kind               JobKind       `json:"kind"`
+	Args               []string      `json:"args,omitempty"`
+	Includes           []string      `json:"includes,omitempty"`
+	Excludes           []string      `json:"excludes,omitempty"`
+	Tag                string        `json:"tag,omitempty"`
+	ForgetGroups       []ForgetGroup `json:"forget_groups,omitempty"`
+	RequiresAdminCreds bool          `json:"requires_admin_creds,omitempty"`
 }
 
 // CommandCancelPayload is the server → agent cancel signal.