agent+server: apply host bandwidth caps to restic invocations

P2R-13a. restic.Env gains LimitUploadKBps/LimitDownloadKBps which are
emitted as global --limit-upload/--limit-download flags before the
subcommand on every invocation. Agent dispatcher tracks host-wide
caps received via config.update; server pushes them on hello and
after PUT /api/hosts/{id}/bandwidth.

Also extends api.CommandRunPayload with optional per-job overrides
(BandwidthUpKBps/Down + PreHook/PostHook); the override consumers
land in T2/T6.

internal/api/messages.go

@@ -130,6 +130,19 @@ type CommandRunPayload struct {
 	Tag                string        `json:"tag,omitempty"`
 	ForgetGroups       []ForgetGroup `json:"forget_groups,omitempty"`
 	RequiresAdminCreds bool          `json:"requires_admin_creds,omitempty"`
+
+	// Per-job bandwidth caps in KB/s. When nil, the agent uses the
+	// host-wide caps it received via config.update. When non-nil,
+	// the override wins for this job only — even a non-nil zero
+	// pointer means "no cap for this job" (caller's explicit choice).
+	BandwidthUpKBps   *int `json:"bandwidth_up_kbps,omitempty"`
+	BandwidthDownKBps *int `json:"bandwidth_down_kbps,omitempty"`
+
+	// Hooks run only for kind=backup. Server resolves source-group
+	// hook → host default → empty before dispatching, so the agent
+	// just executes whatever is here.
+	PreHook  string `json:"pre_hook,omitempty"`
+	PostHook string `json:"post_hook,omitempty"`
 }
 
 // CommandCancelPayload is the server → agent cancel signal.
@@ -306,6 +319,14 @@ type ConfigUpdatePayload struct {
 	RepoCredential string `json:"repo_credential,omitempty"` // sensitive (for rest server basic auth)
 	HookShell      string `json:"hook_shell,omitempty"`
 	Slot           string `json:"slot,omitempty"`
+
+	// Bandwidth caps in KB/s. Pointer semantics so the server can
+	// disambiguate "no change in this push" (nil → omitted on the
+	// wire) from "explicitly clear the cap" (zero or negative value).
+	// Applied to every restic invocation as --limit-upload /
+	// --limit-download. Per-job overrides ride on CommandRunPayload.
+	BandwidthUpKBps   *int `json:"bandwidth_up_kbps,omitempty"`
+	BandwidthDownKBps *int `json:"bandwidth_down_kbps,omitempty"`
 }
 
 // AgentUpdateAvailablePayload — informational only; the agent does