slice 8B (agent half): /backup/due cadence policy + /backup/status phases (v0.11.0)

internal/localapi: real /backup/due (cadence; due when no successful backup or
newest older than backup.backup_cadence_seconds; false in-window after success;
failed doesn't count) + /backup/status phases (idle|running|done|failed + job
id) + POST /backup single-flight with job id. Drives the controller quiesce loop.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/config/config.go

@@ -139,6 +139,19 @@ type BackupConfig struct {
 	// PBSSecretDir holds the per-storage PBS token secret files (<id>.pw). Default
 	// /etc/pve/priv/storage (PVE-managed, 0600). The agent reads it at runtime; never logged.
 	PBSSecretDir string `json:"pbs_secret_dir"`
+
+	// BackupCadenceSeconds drives the local-API GET /backup/due (slice 8B): a guest is "due" when
+	// its newest successful backup is older than this (or none exists). 0 → default (24h). The
+	// hub-served per-guest policy is slice 10; this is the agent-local cadence.
+	BackupCadenceSeconds int `json:"backup_cadence_seconds"`
+}
+
+// BackupCadence returns the per-guest /backup/due window: positive as-is, else 24h default.
+func (b BackupConfig) BackupCadence() time.Duration {
+	if b.BackupCadenceSeconds > 0 {
+		return time.Duration(b.BackupCadenceSeconds) * time.Second
+	}
+	return 24 * time.Hour
 }
 
 // Default scratch VMID band + restore-test cadence.