P1-26: live job log viewer + WS browser fan-out hub

Closes the P1-21 remainder.

internal/server/ws/jobhub.go — new JobHub. Per-job_id set of
subscribers; each gets a 64-deep buffered channel with a writer
goroutine. Broadcast is non-blocking: if a subscriber is slow,
its channel fills and messages are dropped for that subscriber
only — the agent's read loop is never blocked by a stuck browser.

The agent dispatchAgentMessage path mirrors job.started /
job.progress / log.stream / job.finished envelopes onto the hub
in addition to its existing persistence work. The wire shape is
the same end-to-end, so client-side JS switches on env.type the
same way Go code does.

GET /api/jobs/{id}/stream is the browser endpoint. Auth via
session cookie (HTTP layer); upgrade; subscribe; pump until
context closes.

GET /jobs/{id} renders the live log page. Three states (queued/
running/succeeded/failed) drive the header pill, the progress
bar block, the failure summary panel, and the action button
(Cancel job while running, Back to host afterwards). Already-
persisted log lines are server-rendered on initial load; new
lines arrive over the WS and append to #log-stream. Auto-scrolls
unless the user scrolls up (a "⇢ Follow" pill re-attaches).
On job.finished the page reloads after 600ms to pick up the
final-state header rendered server-side.

POST /hosts/{id}/run-backup now sets HX-Redirect → /jobs/{job_id}
on success so HTMX lands the operator straight on the live log.
For non-HTMX callers (curl / plain form post) it 303s to the
same target.

store.ListJobLogs returns persisted log lines for initial render
on page load.

Browser-verified end-to-end: enrol → run a real backup against a
sibling restic/rest-server → live progress + 11 log lines stream
in → succeeded pill + final stats land after page reload.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/server/ws/handler.go

@@ -19,8 +19,9 @@ import (
 
 // HandlerDeps is the set of collaborators the agent WS handler needs.
 type HandlerDeps struct {
-	Hub   *Hub
-	Store *store.Store
+	Hub    *Hub
+	Store  *store.Store
+	JobHub *JobHub
 	// OnHello is called once per successful hello, after the host row
 	// has been touched and the conn registered. Used by the HTTP
 	// layer to push host_credentials down as a config.update before
@@ -172,12 +173,20 @@ func dispatchAgentMessage(ctx context.Context, c *Conn, hostID string, env api.E
 		if err := deps.Store.MarkJobStarted(ctx, p.JobID, p.StartedAt); err != nil {
 			slog.Warn("ws: mark job started", "job_id", p.JobID, "err", err)
 		}
+		if deps.JobHub != nil {
+			deps.JobHub.Broadcast(p.JobID, env)
+		}
 
 	case api.MsgJobProgress:
-		// We don't persist every progress tick; the live UI subscribes
-		// to a fan-out channel that lands with P1-21 / the UI work.
-		// TODO: implement the ws fan-out hub for browsers.
-		_ = env
+		// Progress ticks aren't persisted (1Hz × every job × every
+		// path-walk would dwarf the rest of the DB). The live UI
+		// subscribes to JobHub and gets them in real time; once a
+		// job finishes the final summary lands via job.finished.
+		var p api.JobProgressPayload
+		_ = env.UnmarshalPayload(&p)
+		if deps.JobHub != nil {
+			deps.JobHub.Broadcast(p.JobID, env)
+		}
 
 	case api.MsgJobFinished:
 		var p api.JobFinishedPayload
@@ -187,6 +196,9 @@ func dispatchAgentMessage(ctx context.Context, c *Conn, hostID string, env api.E
 			string(p.Status), p.ExitCode, p.Stats, errMsg, p.FinishedAt); err != nil {
 			slog.Warn("ws: mark job finished", "job_id", p.JobID, "err", err)
 		}
+		if deps.JobHub != nil {
+			deps.JobHub.Broadcast(p.JobID, env)
+		}
 
 	case api.MsgLogStream:
 		var p api.LogStreamLine
@@ -195,6 +207,9 @@ func dispatchAgentMessage(ctx context.Context, c *Conn, hostID string, env api.E
 			string(p.Stream), p.Payload); err != nil {
 			slog.Warn("ws: append job log", "job_id", p.JobID, "err", err)
 		}
+		if deps.JobHub != nil {
+			deps.JobHub.Broadcast(p.JobID, env)
+		}
 
 	case api.MsgSnapshotsRpt:
 		var p api.SnapshotsReportPayload