P1-26: live job log viewer + WS browser fan-out hub

Closes the P1-21 remainder.

internal/server/ws/jobhub.go — new JobHub. Per-job_id set of
subscribers; each gets a 64-deep buffered channel with a writer
goroutine. Broadcast is non-blocking: if a subscriber is slow,
its channel fills and messages are dropped for that subscriber
only — the agent's read loop is never blocked by a stuck browser.

The agent dispatchAgentMessage path mirrors job.started /
job.progress / log.stream / job.finished envelopes onto the hub
in addition to its existing persistence work. The wire shape is
the same end-to-end, so client-side JS switches on env.type the
same way Go code does.

GET /api/jobs/{id}/stream is the browser endpoint. Auth via
session cookie (HTTP layer); upgrade; subscribe; pump until
context closes.

GET /jobs/{id} renders the live log page. Three states (queued/
running/succeeded/failed) drive the header pill, the progress
bar block, the failure summary panel, and the action button
(Cancel job while running, Back to host afterwards). Already-
persisted log lines are server-rendered on initial load; new
lines arrive over the WS and append to #log-stream. Auto-scrolls
unless the user scrolls up (a "⇢ Follow" pill re-attaches).
On job.finished the page reloads after 600ms to pick up the
final-state header rendered server-side.

POST /hosts/{id}/run-backup now sets HX-Redirect → /jobs/{job_id}
on success so HTMX lands the operator straight on the live log.
For non-HTMX callers (curl / plain form post) it 303s to the
same target.

store.ListJobLogs returns persisted log lines for initial render
on page load.

Browser-verified end-to-end: enrol → run a real backup against a
sibling restic/rest-server → live progress + 11 log lines stream
in → succeeded pill + final stats land after page reload.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/server/http/server.go

@@ -22,11 +22,12 @@ import (
 // Deps bundles every collaborator the HTTP server depends on. Wired up
 // in cmd/server; tests pass a pared-down Deps with fakes.
 type Deps struct {
-	Cfg   config.Config
-	Store *store.Store
-	AEAD  *crypto.AEAD
-	Hub   *ws.Hub
-	UI    *ui.Renderer
+	Cfg    config.Config
+	Store  *store.Store
+	AEAD   *crypto.AEAD
+	Hub    *ws.Hub
+	JobHub *ws.JobHub
+	UI     *ui.Renderer
 	// Version is the binary's build version, surfaced in the chrome.
 	// Empty falls back to "dev".
 	Version string
@@ -110,6 +111,7 @@ func (s *Server) routes(r chi.Router) {
 		r.Mount("/ws/agent", ws.AgentHandler(ws.HandlerDeps{
 			Hub:     s.deps.Hub,
 			Store:   s.deps.Store,
+			JobHub:  s.deps.JobHub,
 			OnHello: s.onAgentHello,
 		}))
 	}
@@ -138,6 +140,15 @@ func (s *Server) routes(r chi.Router) {
 		r.Post("/hosts/new", s.handleUIAddHostPost)
 		// Host detail (Snapshots tab is the default).
 		r.Get("/hosts/{id}", s.handleUIHostDetail)
+		// Live job log.
+		r.Get("/jobs/{id}", s.handleUIJobDetail)
+	}
+
+	// Browser job-log stream (separate from /ws/agent so the auth
+	// layer is session-cookie not bearer). Mounted regardless of
+	// whether the UI is up — JSON callers may also subscribe.
+	if s.deps.JobHub != nil {
+		r.Get("/api/jobs/{id}/stream", s.handleJobStream)
 	}
 }