Add-host: default repo username to hostname; always show htpasswd snippet

The pending page suppressed the htpasswd snippet when repo_username
was blank — but with --private-repos the username is required for
auth, and operators routinely leave the field blank assuming the
system will pick something sensible.

* handleUIAddHostPost defaults repo_username to the typed hostname
  when blank. Matches what --private-repos expects (URL path
  segment == username).
* pending_host.html: snippet now renders whenever a password is
  present (always true after the generate-on-blank logic landed
  earlier).
* Form help-text updated to describe the default explicitly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/server/http/ui_handlers.go

@@ -370,8 +370,18 @@ func (s *Server) handleUIAddHostPost(w stdhttp.ResponseWriter, r *stdhttp.Reques
 		}
 	}
 
+	// Default repo username to the hostname when the operator left it
+	// blank. With rest-server's --private-repos this is what the URL
+	// path segment is expected to be anyway, and an htpasswd entry
+	// always needs *some* user — defaulting saves the operator from
+	// landing on a pending page with a half-formed snippet.
+	repoUsername := page.RepoUsername
+	if repoUsername == "" {
+		repoUsername = page.Hostname
+	}
+
 	if page.Error == "" {
-		token, _, err := s.mintEnrollmentToken(r.Context(), page.RepoURL, page.RepoUsername, repoPassword, splitPaths(page.Paths))
+		token, _, err := s.mintEnrollmentToken(r.Context(), page.RepoURL, repoUsername, repoPassword, splitPaths(page.Paths))
 		switch err {
 		case nil:
 			stdhttp.Redirect(w, r, "/hosts/pending/"+token, stdhttp.StatusSeeOther)

web/templates/pages/add_host.html

@@ -58,9 +58,9 @@
         <div class="field-help">Whatever <span class="mono text-ink-mid">restic -r</span> would accept. Most fleets terminate at a <span class="mono text-ink-mid">restic/rest-server</span>; <span class="mono text-ink-mid">s3:</span> and <span class="mono text-ink-mid">b2:</span> URLs work equally well.</div>
       </div>
       <div class="mb-5">
-        <label class="field-label" for="ah-user">Repo username <span class="text-ink-fade font-normal">· optional</span></label>
+        <label class="field-label" for="ah-user">Repo username <span class="text-ink-fade font-normal">· optional — defaults to hostname</span></label>
         <input id="ah-user" name="repo_username" type="text" class="field mono" value="{{$page.RepoUsername}}">
-        <div class="field-help">For <span class="mono text-ink-mid">rest-server</span> with htpasswd, this is the per-host user.</div>
+        <div class="field-help">For <span class="mono text-ink-mid">rest-server</span> with <span class="mono text-ink-mid">--private-repos</span>, this is the per-host htpasswd user — and the URL path segment must match. Leave blank and we'll use the hostname above.</div>
       </div>
       <div class="mb-7">
         <label class="field-label" for="ah-pass">Repo password <span class="text-ink-fade font-normal">· optional — leave blank to generate</span></label>

web/templates/pages/pending_host.html

@@ -27,7 +27,7 @@
     the host detail.
   </p>
 
-  {{if and $page.RepoUsername $page.RepoPassword}}
+  {{if $page.RepoPassword}}
   <div class="snippet mt-6 panel" style="border-color: color-mix(in oklch, var(--warn), transparent 60%);">
     <div class="snippet-head" style="background: color-mix(in oklch, var(--warn), transparent 92%);">
       <span>