server: populate audit UserID on credential mutations + slog prune push errors

Switch handleSetHostCredentials, handleSetAdminCredentials, and
handleDeleteAdminCredentials from authedUser (bool) to requireUser
(*store.User) so AuditEntry.UserID and Actor are populated correctly.
Add slog.Warn on the non-ErrNotFound pushAdminCredsToAgent path in
handleRunRepoPrune so decrypt/send failures surface in the server log
rather than appearing as a generic host_offline 503.

internal/server/http/repo_ops.go

@@ -6,6 +6,7 @@ package http
 
 import (
 	"errors"
+	"log/slog"
 	stdhttp "net/http"
 	"strconv"
 
@@ -45,6 +46,7 @@ func (s *Server) handleRunRepoPrune(w stdhttp.ResponseWriter, r *stdhttp.Request
 		// Hub.Send failure (offline) or decrypt failure — surface a
 		// generic offline message so the operator retries when the
 		// agent is back.
+		slog.Warn("prune: push admin creds failed", "host_id", hostID, "err", err)
 		s.runOpError(w, r, stdhttp.StatusServiceUnavailable, "host_offline",
 			"agent is not currently connected; try again when it reconnects")
 		return