P2R-01 follow-up: WS-path tests + drop unused retention from backup dispatch

Adds p2r01_ws_test.go covering the two paths the original commit's
in-process tests couldn't reach without a live conn:

- maybeAutoInit dispatches command.run(init) on first hello when creds
  are bound, skips on second hello once a job row exists, and skips
  entirely when the host has no creds.
- dispatchScheduledJob iterates a schedule's source groups and emits
  one backup per group with the right Tag/Includes; persists job rows
  with actor_kind=schedule + scheduled_id; no-ops on a disabled
  schedule.

Drops RetentionPolicy from the per-group Run-now and schedule.fire
backup payloads — the agent's RunBackup ignores it (forget is the
only consumer). Adds Hub.Conn() so tests can grab the live *Conn
post-hello.

internal/server/http/run_group.go

@@ -7,7 +7,6 @@
 package http
 
 import (
-	"encoding/json"
 	"errors"
 	stdhttp "net/http"
 
@@ -41,13 +40,13 @@ func (s *Server) handleRunSourceGroup(w stdhttp.ResponseWriter, r *stdhttp.Reque
 		return
 	}
 
-	retention, _ := json.Marshal(g.RetentionPolicy)
+	// Backup invocations don't consume RetentionPolicy — that lives on
+	// forget. Sending the resolved set here would just be dead weight.
 	res, status, code, msg := s.dispatchJobWithPayload(r.Context(), user, hostID, api.JobBackup,
 		api.CommandRunPayload{
-			Includes:        g.Includes,
-			Excludes:        g.Excludes,
-			Tag:             g.Name,
-			RetentionPolicy: retention,
+			Includes: g.Includes,
+			Excludes: g.Excludes,
+			Tag:      g.Name,
 		})
 	if code != "" {
 		s.runGroupError(w, r, status, code, msg)