P2R-01: REST + WS rewire against the slim shape

Schedules CRUD now takes {cron, enabled, source_group_ids[]} with cron
parsed via robfig/cron/v3 and group membership scoped to the host.
New source-groups CRUD lives at /api/hosts/{id}/source-groups; delete
refuses with 409 if any schedule still references the group, returning
the schedule list so the UI can prompt 'remove from these schedules
first.' Repo-maintenance GET/PUT manages forget/prune/check cadences
on host_repo_maintenance — no version bump, the server-side ticker
(P2R-06) drives execution.

Per-source-group Run-now (POST /hosts/{id}/source-groups/{gid}/run)
resolves the group's includes/excludes/retention/tag and dispatches a
backup command.run with the new structured CommandRunPayload fields
(Includes/Excludes/Tag). Old per-host /hosts/{id}/run-backup and
/hosts/{id}/init-repo return 410 Gone with a redirect message.

schedule_push.go is rebuilt: buildScheduleSetPayload assembles the
slim wire shape, pushScheduleSetOnConn ships it during the on-hello
window, pushScheduleSetAsync fires after every CRUD mutation, and
dispatchScheduledJob handles agent schedule.fire by iterating the
schedule's source groups and dispatching one backup per group with
actor_kind=schedule and scheduled_id pointing at the schedule.

Auto-init at first WS connect: when the host has repo creds bound and
no init job in its history, server dispatches restic init. Restic's
'config file already exists' soft-success means re-runs against an
existing repo no-op; we don't auto-retry on failure (operator triggers
re-init manually via the danger zone in P2R-09).

api.Schedule drops Kind/Paths/Excludes/Tags/RetentionPolicy/Manual etc.
in favour of {id, cron, enabled, source_groups: [...]}. The agent
scheduler stops checking sch.Manual; cmd/agent's backup dispatch reads
Includes/Excludes/Tag instead of Args.

Tests cover the new HTTP surface end-to-end: source-groups CRUD with
in-use refusal, schedule validation (bad cron / missing groups /
foreign group), repo-maintenance auto-seed and validation, the 410
route, and buildScheduleSetPayload's wire-shape correctness. Full
suite passes; smoke env exercises auto-init dispatch on hello,
async push after schedule create, and per-source-group Run-now
landing the right paths/excludes/tag at the agent.

internal/server/http/jobs.go

@@ -64,6 +64,19 @@ func (s *Server) handleRunNow(w stdhttp.ResponseWriter, r *stdhttp.Request) {
 // flash banner + redirect.
 func (s *Server) dispatchJob(ctx context.Context, user *store.User,
 	hostID string, kind api.JobKind, args []string,
+) (res runNowResponse, status int, code, msg string) {
+	return s.dispatchJobWithPayload(ctx, user, hostID, kind, api.CommandRunPayload{
+		Kind: kind,
+		Args: args,
+	})
+}
+
+// dispatchJobWithPayload is dispatchJob's variant that lets callers
+// fill in structured fields (Includes/Excludes/Tag/RetentionPolicy)
+// — used by the per-source-group Run-now path. JobID is filled in
+// here; callers leave it zero on the input payload.
+func (s *Server) dispatchJobWithPayload(ctx context.Context, user *store.User,
+	hostID string, kind api.JobKind, payload api.CommandRunPayload,
 ) (res runNowResponse, status int, code, msg string) {
 	if !validJobKind(kind) {
 		return res, stdhttp.StatusBadRequest, "invalid_kind",
@@ -80,22 +93,26 @@ func (s *Server) dispatchJob(ctx context.Context, user *store.User,
 
 	jobID := ulid.Make().String()
 	now := time.Now().UTC()
+	var actorID *string
+	actor := "system"
+	if user != nil {
+		actor = "user"
+		actorID = &user.ID
+	}
 	if err := s.deps.Store.CreateJob(ctx, store.Job{
 		ID:        jobID,
 		HostID:    host.ID,
 		Kind:      string(kind),
-		ActorKind: "user",
-		ActorID:   &user.ID,
+		ActorKind: actor,
+		ActorID:   actorID,
 		CreatedAt: now,
 	}); err != nil {
 		return res, stdhttp.StatusInternalServerError, "internal", ""
 	}
 
-	env, err := api.Marshal(api.MsgCommandRun, jobID, api.CommandRunPayload{
-		JobID: jobID,
-		Kind:  kind,
-		Args:  args,
-	})
+	payload.JobID = jobID
+	payload.Kind = kind
+	env, err := api.Marshal(api.MsgCommandRun, jobID, payload)
 	if err != nil {
 		return res, stdhttp.StatusInternalServerError, "internal", ""
 	}
@@ -105,8 +122,8 @@ func (s *Server) dispatchJob(ctx context.Context, user *store.User,
 
 	_ = s.deps.Store.AppendAudit(ctx, store.AuditEntry{
 		ID:         ulid.Make().String(),
-		UserID:     &user.ID,
-		Actor:      "user",
+		UserID:     actorID,
+		Actor:      actor,
 		Action:     "job.run_now",
 		TargetKind: ptr("job"),
 		TargetID:   &jobID,