P2R-01: REST + WS rewire against the slim shape

Schedules CRUD now takes {cron, enabled, source_group_ids[]} with cron
parsed via robfig/cron/v3 and group membership scoped to the host.
New source-groups CRUD lives at /api/hosts/{id}/source-groups; delete
refuses with 409 if any schedule still references the group, returning
the schedule list so the UI can prompt 'remove from these schedules
first.' Repo-maintenance GET/PUT manages forget/prune/check cadences
on host_repo_maintenance — no version bump, the server-side ticker
(P2R-06) drives execution.

Per-source-group Run-now (POST /hosts/{id}/source-groups/{gid}/run)
resolves the group's includes/excludes/retention/tag and dispatches a
backup command.run with the new structured CommandRunPayload fields
(Includes/Excludes/Tag). Old per-host /hosts/{id}/run-backup and
/hosts/{id}/init-repo return 410 Gone with a redirect message.

schedule_push.go is rebuilt: buildScheduleSetPayload assembles the
slim wire shape, pushScheduleSetOnConn ships it during the on-hello
window, pushScheduleSetAsync fires after every CRUD mutation, and
dispatchScheduledJob handles agent schedule.fire by iterating the
schedule's source groups and dispatching one backup per group with
actor_kind=schedule and scheduled_id pointing at the schedule.

Auto-init at first WS connect: when the host has repo creds bound and
no init job in its history, server dispatches restic init. Restic's
'config file already exists' soft-success means re-runs against an
existing repo no-op; we don't auto-retry on failure (operator triggers
re-init manually via the danger zone in P2R-09).

api.Schedule drops Kind/Paths/Excludes/Tags/RetentionPolicy/Manual etc.
in favour of {id, cron, enabled, source_groups: [...]}. The agent
scheduler stops checking sch.Manual; cmd/agent's backup dispatch reads
Includes/Excludes/Tag instead of Args.

Tests cover the new HTTP surface end-to-end: source-groups CRUD with
in-use refusal, schedule validation (bad cron / missing groups /
foreign group), repo-maintenance auto-seed and validation, the 410
route, and buildScheduleSetPayload's wire-shape correctness. Full
suite passes; smoke env exercises auto-init dispatch on hello,
async push after schedule create, and per-source-group Run-now
landing the right paths/excludes/tag at the agent.

internal/agent/scheduler/scheduler.go

@@ -88,13 +88,6 @@ func (s *Scheduler) Apply(payload api.ScheduleSetPayload, tx Sender) {
 		if !sch.Enabled {
 			continue
 		}
-		// Manual schedules carry paths/retention/etc. but have no
-		// cron — they only fire via operator-driven run-now (which
-		// the server resolves directly via dispatchScheduledJob).
-		// Skip without warning: they're a normal data shape.
-		if sch.Manual {
-			continue
-		}
 		// Capture by value so the closure doesn't share id across iters.
 		entry := sch
 		_, err := c.AddFunc(entry.CronExpr, func() {

internal/agent/scheduler/scheduler_test.go

@@ -39,7 +39,7 @@ func TestApplyEmitsAck(t *testing.T) {
 	s.Apply(api.ScheduleSetPayload{
 		Version: 7,
 		Schedules: []api.Schedule{
-			{ID: "s1", Kind: api.JobBackup, CronExpr: "@hourly", Enabled: true},
+			{ID: "s1", CronExpr: "@hourly", Enabled: true},
 		},
 	}, tx)
 
@@ -72,7 +72,7 @@ func TestApplyTickFiresScheduleFire(t *testing.T) {
 	s.Apply(api.ScheduleSetPayload{
 		Version: 1,
 		Schedules: []api.Schedule{
-			{ID: "every-second", Kind: api.JobBackup, CronExpr: "@every 1s", Enabled: true},
+			{ID: "every-second", CronExpr: "@every 1s", Enabled: true},
 		},
 	}, tx)
 
@@ -102,7 +102,7 @@ func TestApplyDisabledEntriesSkipped(t *testing.T) {
 	s.Apply(api.ScheduleSetPayload{
 		Version: 1,
 		Schedules: []api.Schedule{
-			{ID: "off", Kind: api.JobBackup, CronExpr: "@every 1s", Enabled: false},
+			{ID: "off", CronExpr: "@every 1s", Enabled: false},
 		},
 	}, tx)
 
@@ -125,7 +125,7 @@ func TestApplyReplacesPriorState(t *testing.T) {
 	s.Apply(api.ScheduleSetPayload{
 		Version: 1,
 		Schedules: []api.Schedule{
-			{ID: "old", Kind: api.JobBackup, CronExpr: "@every 1s", Enabled: true},
+			{ID: "old", CronExpr: "@every 1s", Enabled: true},
 		},
 	}, tx)