ui+server: per-job bandwidth override on Run-now

P2R-13b. POST /hosts/{id}/source-groups/{gid}/run accepts optional
bandwidth_up_kbps / bandwidth_down_kbps form fields, plumbs them onto
CommandRunPayload. Agent dispatcher already prefers per-job override
over host-wide caps (T1). UI wraps the Run-now button in a form with
a <details> 'Limit bandwidth for this run' disclosure containing two
KB/s inputs.

internal/server/http/run_group.go

@@ -9,6 +9,7 @@ package http
 import (
 	"errors"
 	stdhttp "net/http"
+	"strconv"
 
 	"github.com/go-chi/chi/v5"
 
@@ -16,6 +17,34 @@ import (
 	"gitea.dcglab.co.uk/steve/restic-manager/internal/store"
 )
 
+// parseBandwidthOverride pulls optional bandwidth_up_kbps /
+// bandwidth_down_kbps from the request (form or query). Returns nil
+// for any field absent or empty; an explicit "0" produces a non-nil
+// pointer to 0 — i.e., "no cap for this run, even if the host has
+// one set." Non-integers / negatives are rejected with an error.
+func parseBandwidthOverride(r *stdhttp.Request) (up *int, down *int, err error) {
+	parse := func(name string) (*int, error) {
+		v := r.FormValue(name)
+		if v == "" {
+			return nil, nil
+		}
+		n, perr := strconv.Atoi(v)
+		if perr != nil {
+			return nil, errors.New(name + " must be an integer")
+		}
+		if n < 0 {
+			return nil, errors.New(name + " must be >= 0")
+		}
+		return &n, nil
+	}
+	up, err = parse("bandwidth_up_kbps")
+	if err != nil {
+		return nil, nil, err
+	}
+	down, err = parse("bandwidth_down_kbps")
+	return up, down, err
+}
+
 func (s *Server) handleRunSourceGroup(w stdhttp.ResponseWriter, r *stdhttp.Request) {
 	user, ok := s.requireUser(r)
 	if !ok {
@@ -40,13 +69,25 @@ func (s *Server) handleRunSourceGroup(w stdhttp.ResponseWriter, r *stdhttp.Reque
 		return
 	}
 
+	// Optional per-run bandwidth override. Disclosed in the UI under a
+	// <details> "Limit bandwidth for this run" affordance; absent on
+	// the wire (and from JSON callers that don't supply it) means
+	// "fall back to the host's standing caps."
+	upOverride, downOverride, perr := parseBandwidthOverride(r)
+	if perr != nil {
+		s.runGroupError(w, r, stdhttp.StatusBadRequest, "invalid_value", perr.Error())
+		return
+	}
+
 	// Backup invocations don't consume RetentionPolicy — that lives on
 	// forget. Sending the resolved set here would just be dead weight.
 	res, status, code, msg := s.dispatchJobWithPayload(r.Context(), user, hostID, api.JobBackup,
 		api.CommandRunPayload{
-			Includes: g.Includes,
-			Excludes: g.Excludes,
-			Tag:      g.Name,
+			Includes:          g.Includes,
+			Excludes:          g.Excludes,
+			Tag:               g.Name,
+			BandwidthUpKBps:   upOverride,
+			BandwidthDownKBps: downOverride,
 		})
 	if code != "" {
 		s.runGroupError(w, r, status, code, msg)