P2R-01: REST + WS rewire against the slim shape

Schedules CRUD now takes {cron, enabled, source_group_ids[]} with cron
parsed via robfig/cron/v3 and group membership scoped to the host.
New source-groups CRUD lives at /api/hosts/{id}/source-groups; delete
refuses with 409 if any schedule still references the group, returning
the schedule list so the UI can prompt 'remove from these schedules
first.' Repo-maintenance GET/PUT manages forget/prune/check cadences
on host_repo_maintenance — no version bump, the server-side ticker
(P2R-06) drives execution.

Per-source-group Run-now (POST /hosts/{id}/source-groups/{gid}/run)
resolves the group's includes/excludes/retention/tag and dispatches a
backup command.run with the new structured CommandRunPayload fields
(Includes/Excludes/Tag). Old per-host /hosts/{id}/run-backup and
/hosts/{id}/init-repo return 410 Gone with a redirect message.

schedule_push.go is rebuilt: buildScheduleSetPayload assembles the
slim wire shape, pushScheduleSetOnConn ships it during the on-hello
window, pushScheduleSetAsync fires after every CRUD mutation, and
dispatchScheduledJob handles agent schedule.fire by iterating the
schedule's source groups and dispatching one backup per group with
actor_kind=schedule and scheduled_id pointing at the schedule.

Auto-init at first WS connect: when the host has repo creds bound and
no init job in its history, server dispatches restic init. Restic's
'config file already exists' soft-success means re-runs against an
existing repo no-op; we don't auto-retry on failure (operator triggers
re-init manually via the danger zone in P2R-09).

api.Schedule drops Kind/Paths/Excludes/Tags/RetentionPolicy/Manual etc.
in favour of {id, cron, enabled, source_groups: [...]}. The agent
scheduler stops checking sch.Manual; cmd/agent's backup dispatch reads
Includes/Excludes/Tag instead of Args.

Tests cover the new HTTP surface end-to-end: source-groups CRUD with
in-use refusal, schedule validation (bad cron / missing groups /
foreign group), repo-maintenance auto-seed and validation, the 410
route, and buildScheduleSetPayload's wire-shape correctness. Full
suite passes; smoke env exercises auto-init dispatch on hello,
async push after schedule create, and per-source-group Run-now
landing the right paths/excludes/tag at the agent.

internal/server/http/run_group.go

@@ -0,0 +1,83 @@
+// run_group.go — per-source-group Run-now endpoint.
+//
+// POST /hosts/{id}/source-groups/{gid}/run dispatches a backup job
+// against the resolved includes/excludes/retention/tag of the named
+// group. Replaces the old per-host /hosts/{id}/run-backup route (now
+// 410 Gone).
+package http
+
+import (
+	"encoding/json"
+	"errors"
+	stdhttp "net/http"
+
+	"github.com/go-chi/chi/v5"
+
+	"gitea.dcglab.co.uk/steve/restic-manager/internal/api"
+	"gitea.dcglab.co.uk/steve/restic-manager/internal/store"
+)
+
+func (s *Server) handleRunSourceGroup(w stdhttp.ResponseWriter, r *stdhttp.Request) {
+	user, ok := s.requireUser(r)
+	if !ok {
+		// HTML callers redirect to login; for JSON return 401.
+		if wantsHTML(r) {
+			stdhttp.Redirect(w, r, "/login", stdhttp.StatusSeeOther)
+			return
+		}
+		writeJSONError(w, stdhttp.StatusUnauthorized, "unauthorized", "")
+		return
+	}
+	hostID := chi.URLParam(r, "id")
+	groupID := chi.URLParam(r, "gid")
+	g, err := s.deps.Store.GetSourceGroup(r.Context(), hostID, groupID)
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			s.runGroupError(w, r, stdhttp.StatusNotFound, "group_not_found",
+				"source group not found on this host")
+			return
+		}
+		s.runGroupError(w, r, stdhttp.StatusInternalServerError, "internal", "")
+		return
+	}
+
+	retention, _ := json.Marshal(g.RetentionPolicy)
+	res, status, code, msg := s.dispatchJobWithPayload(r.Context(), user, hostID, api.JobBackup,
+		api.CommandRunPayload{
+			Includes:        g.Includes,
+			Excludes:        g.Excludes,
+			Tag:             g.Name,
+			RetentionPolicy: retention,
+		})
+	if code != "" {
+		s.runGroupError(w, r, status, code, msg)
+		return
+	}
+	if wantsHTML(r) {
+		// HTMX action: redirect to the live job log so the operator
+		// sees streaming output immediately.
+		w.Header().Set("HX-Redirect", "/jobs/"+res.JobID)
+		w.WriteHeader(stdhttp.StatusNoContent)
+		return
+	}
+	writeJSON(w, stdhttp.StatusAccepted, res)
+}
+
+// runGroupError dispatches an error to JSON callers as the standard
+// envelope; HTMX callers get a 4xx with a plain text body so the
+// browser surfaces it via the existing toast handler.
+func (s *Server) runGroupError(w stdhttp.ResponseWriter, r *stdhttp.Request, status int, code, msg string) {
+	if wantsHTML(r) {
+		stdhttp.Error(w, msg, status)
+		return
+	}
+	writeJSONError(w, status, code, msg)
+}
+
+// wantsHTML keys off HX-Request only. Browsers sending a default
+// Accept (or curl's `*/*`) get the JSON shape, which is the safer
+// default for non-htmx clients. HTMX always sets HX-Request=true on
+// its action POSTs, so the form path is unambiguous.
+func wantsHTML(r *stdhttp.Request) bool {
+	return r.Header.Get("HX-Request") == "true"
+}