P2R-01 follow-up: WS-path tests + drop unused retention from backup dispatch

Adds p2r01_ws_test.go covering the two paths the original commit's
in-process tests couldn't reach without a live conn:

- maybeAutoInit dispatches command.run(init) on first hello when creds
  are bound, skips on second hello once a job row exists, and skips
  entirely when the host has no creds.
- dispatchScheduledJob iterates a schedule's source groups and emits
  one backup per group with the right Tag/Includes; persists job rows
  with actor_kind=schedule + scheduled_id; no-ops on a disabled
  schedule.

Drops RetentionPolicy from the per-group Run-now and schedule.fire
backup payloads — the agent's RunBackup ignores it (forget is the
only consumer). Adds Hub.Conn() so tests can grab the live *Conn
post-hello.

internal/server/ws/hub.go

@@ -81,6 +81,17 @@ func (h *Hub) Connected(hostID string) bool {
 	return ok
 }
 
+// Conn returns the canonical connection for hostID, or nil if the
+// host is offline. Tests use this to obtain a *Conn for direct calls
+// into handlers that take one. Production code should prefer Send,
+// which avoids holding a reference past the point where a supersede
+// might have replaced the conn.
+func (h *Hub) Conn(hostID string) *Conn {
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+	return h.conns[hostID]
+}
+
 // ----- Conn methods --------------------------------------------------
 
 // NewConn wraps a freshly-accepted websocket for a given hostID.