v0.6.0: slice 6 Phase B — PBS offsite tier (verify + PBS-API client + reporting)

Spike-proven that backup/restore-to-PBS reuse Phase A unchanged; the only new code is
the verify capability, a small PBS-API client, and PBSSnapshot reporting.

- internal/pbs: fingerprint-pinned, token-authed PBS-API client (Verify/Snapshots/
  TaskStatus, node-from-UPID; secret read from /etc/pve/priv/storage/<id>.pw at runtime,
  never logged) + the verify maintenance loop (own cadence, default 6h, NOT gated/journaled,
  like the watchdog) + SnapshotStore.
- hub: PBSSnapshot filled (namespace/type/id/time/size/owner/protected/encrypted/
  verify_state/verify_upid); PBSReporter collector seam; cross-repo golden + bidirectional
  key-set tests; hub handler parses pbs_snapshots + logs a failed-verify WARN.
- backup: report the ACTUAL vzdump mode (parsed from the task log; PVE may downgrade
  snapshot->stop). proxmox.Storage.Username. config PBSVerifyCadence/secret-dir.
  --selftest=pbs-verify. Backup/restore-to-PBS unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/backup/backup_test.go

@@ -25,6 +25,7 @@ type fakeBackupAPI struct {
 	content    []proxmox.StorageContent
 	contentErr error
 	vzdumps    []proxmox.VzdumpOptions
+	logLines   []string // returned by TaskLogTail (e.g. "INFO: backup mode: stop")
 }
 
 func (f *fakeBackupAPI) Vzdump(_ context.Context, o proxmox.VzdumpOptions) (string, error) {
@@ -40,6 +41,9 @@ func (f *fakeBackupAPI) GuestConfig(_ context.Context, _ int) (proxmox.GuestConf
 func (f *fakeBackupAPI) StorageContent(_ context.Context, _ string) ([]proxmox.StorageContent, error) {
 	return f.content, f.contentErr
 }
+func (f *fakeBackupAPI) TaskLogTail(_ context.Context, _ string, _ int) ([]string, error) {
+	return f.logLines, nil
+}
 
 // guestCfgWithMounts builds a GuestConfig whose Extra carries the given mpN strings.
 func guestCfgWithMounts(mps map[string]string) proxmox.GuestConfig {
@@ -92,6 +96,23 @@ func TestBackup_SuccessResolvesArchiveAndBulkGap(t *testing.T) {
 	}
 }
 
+func TestBackup_ReportsActualModeFromTaskLog(t *testing.T) {
+	// Requested snapshot, but PVE used stop (stopped guest) — the report must reflect ACTUAL.
+	api := &fakeBackupAPI{
+		vzdumpUPID: "UPID:vzdump:1",
+		content:    []proxmox.StorageContent{{VolID: "v", Content: "backup", VMID: 9001, Size: 10, CTime: 1}},
+		logLines:   []string{"INFO: CT Name: spike", "INFO: backup mode: stop", "INFO: Finished"},
+	}
+	r := NewBackupRunner(api, "local", proxmox.ModeSnapshot, "", quiet())
+	rec, err := r.Backup(context.Background(), 9001)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if rec.Mode != "stop" {
+		t.Errorf("mode = %q, want the ACTUAL %q from the task log (not the requested snapshot)", rec.Mode, "stop")
+	}
+}
+
 func TestBackup_VzdumpFailureReturnsFailedRecord(t *testing.T) {
 	api := &fakeBackupAPI{vzdumpErr: errors.New("vzdump boom")}
 	r := NewBackupRunner(api, "local", "", "", quiet())