P1 polish: agent-as-root, init-repo flow, rest creds passthrough, UX fixes

Cohesive batch from a smoke-test session against a real rest-server.
Themed bullets:

* Agent runs as root, sandboxed via systemd. CapabilityBoundingSet
  drops to CAP_DAC_READ_SEARCH + restore caps; ProtectSystem=strict
  with ReadWritePaths confined to /etc + /var/lib/restic-manager;
  NoNewPrivileges blocks escalation. Install script no longer
  creates a service user. spec.md §4.2 / §14.1 / §14.3 explain the
  rationale (matches UrBackup / Veeam / Bareos defaults; trying to
  back up "everything" as an unprivileged user creates silent skips
  on /home, /root, /var/lib/* with no upside vs the threat model
  the agent already implies).

* Init-repo end-to-end. New JobKind="init" wired through agent
  runner, restic.Env.RunInit, server dispatcher, and a UI button
  (red "Initialise repo" in the run-now panel). hosts.repo_initialised_at
  flips on init success, on backup success, or on a non-empty
  snapshots.report. The "Run now" / "Init" / "Retry" branching now
  drives both the dashboard host row and the host-detail panel.
  Migrations 0004 (column), 0005 (jobs.kind CHECK widened — using
  the safe create-new-then-rename pattern; first version corrupted
  job_logs.job_id FK), 0006 (cleans up job_logs FK on already-
  affected DBs).

* rest-server creds embedded at exec time only. restic.Env gains
  RepoUsername; mergeRestCreds() builds the user:pass@-prefixed URL
  inside envSlice() and never assigns it back to the struct, so
  nothing slog-able ever sees the cleartext form. RedactURL helper
  for any future surface that needs to log a URL safely. Both
  helpers tested.

* Add-host UX. Repo password is now optional — server mints a
  24-byte URL-safe random one and surfaces it once, alongside an
  htpasswd snippet ("echo PASS | htpasswd -B -i ... USERNAME") so
  the operator pastes one command on the rest-server host and one
  on the endpoint. Result page also links the install snippet at
  /install/install.sh (was /install.sh — 404'd before) and pipes
  to bash (not sh — script uses set -o pipefail and other
  bashisms; on Debian/Ubuntu sh is dash).

* Late-subscriber race in JobHub. A fast-failing job could finish
  (DB write + Broadcast) before the browser's HX-Redirect → page
  load → WS-connect path completed, so the JS sat forever waiting
  on a job.finished that already passed. JobHub split into
  Register + Send + Run; handleJobStream now subscribes first,
  re-fetches the job, and sends a synthetic job.finished if the
  state is already terminal.

* HTMX error visibility. New toast partial listens to
  htmx:responseError and surfaces the response body as a
  bottom-right toast — every server-side validation error now
  becomes visible without per-handler JS wiring. Also handles
  custom rm:toast events for future server-pushed notifications
  via the HX-Trigger header. Themed via existing CSS vars.

* Dashboard rows are now whole-row clickable to host detail
  (CSS card-link pattern: absolute-positioned anchor + .row-action
  z-index restoration so the action button stays clickable).
  "View →" on a running job links to /jobs/<id> rather than
  /hosts/<id> since the row click already covers the host page.

* "Run first" / "Run first backup" → "Run now" everywhere for
  consistency.

* runbook (docs/e2e-smoke.md) updated — live-log streaming step
  now reflects P1-26; mentions the browser-driven Run-now flow.

* _diag/dump-creds — moved out of cmd/ so go build doesn't pick
  it up; .gitignore now excludes /_diag/ entirely.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/templates/pages/host_detail.html

@@ -38,13 +38,19 @@
       </div>
     </div>
     <div class="flex items-center gap-2">
-      {{if ne $host.Status "offline"}}
+      {{if eq $host.Status "offline"}}
+        <button class="btn" disabled title="agent is offline">Run backup now</button>
+      {{else if not $host.RepoInitialisedAt}}
+        <button class="btn btn-danger"
+                hx-post="/hosts/{{$host.ID}}/init-repo"
+                hx-swap="none"
+                hx-disabled-elt="this"
+                title="restic repo not yet initialised — run this once before the first backup">Initialise repo</button>
+      {{else}}
         <button class="btn btn-primary"
                 hx-post="/hosts/{{$host.ID}}/run-backup"
                 hx-swap="none"
                 hx-disabled-elt="this">Run backup now</button>
-      {{else}}
-        <button class="btn" disabled title="agent is offline">Run backup now</button>
       {{end}}
       <button class="btn">Edit credentials</button>
       <button class="btn btn-ghost text-base px-2.5">⋯</button>
@@ -113,10 +119,17 @@
             </p>
             {{if ne $host.Status "offline"}}
               <div class="mt-5">
-                <button class="btn btn-primary"
-                        hx-post="/hosts/{{$host.ID}}/run-backup"
-                        hx-swap="none"
-                        hx-disabled-elt="this">Run first backup</button>
+                {{if not $host.RepoInitialisedAt}}
+                  <button class="btn btn-danger"
+                          hx-post="/hosts/{{$host.ID}}/init-repo"
+                          hx-swap="none"
+                          hx-disabled-elt="this">Initialise repo</button>
+                {{else}}
+                  <button class="btn btn-primary"
+                          hx-post="/hosts/{{$host.ID}}/run-backup"
+                          hx-swap="none"
+                          hx-disabled-elt="this">Run now</button>
+                {{end}}
               </div>
             {{end}}
           </div>
@@ -162,10 +175,18 @@
       <div class="panel rounded-[7px] px-4 py-3.5">
         <div class="text-[11px] text-ink-fade uppercase tracking-[0.1em] mb-2.5">Run-now</div>
         <div class="flex flex-col gap-1.5">
-          <button class="btn justify-start w-full {{if eq $host.Status "offline"}}opacity-50 cursor-not-allowed pointer-events-none{{end}}"
+          {{if not $host.RepoInitialisedAt}}
+            <button class="btn justify-start w-full text-bad font-medium {{if eq $host.Status "offline"}}opacity-50 cursor-not-allowed pointer-events-none{{end}}"
+                    hx-post="/hosts/{{$host.ID}}/init-repo"
+                    hx-swap="none"
+                    hx-disabled-elt="this"
+                    title="restic repo not yet initialised — click to run `restic init` once">init</button>
+          {{end}}
+          <button class="btn justify-start w-full {{if or (eq $host.Status "offline") (not $host.RepoInitialisedAt)}}opacity-50 cursor-not-allowed pointer-events-none{{end}}"
                   hx-post="/hosts/{{$host.ID}}/run-backup"
                   hx-swap="none"
-                  hx-disabled-elt="this">backup</button>
+                  hx-disabled-elt="this"
+                  {{if not $host.RepoInitialisedAt}}title="initialise the repo first"{{end}}>backup</button>
           <button class="btn justify-start w-full" disabled title="lands with P2-05">forget <span class="text-[10px] text-ink-fade ml-1.5">P2</span></button>
           <button class="btn justify-start w-full" disabled title="lands with P2-06">prune <span class="text-[10px] text-ink-fade ml-1.5">admin</span></button>
           <button class="btn justify-start w-full" disabled title="lands with P2-07">check <span class="text-[10px] text-ink-fade ml-1.5">P2</span></button>