v0.6.0: slice 6 Phase B — PBS offsite tier (verify + PBS-API client + reporting)

Spike-proven that backup/restore-to-PBS reuse Phase A unchanged; the only new code is
the verify capability, a small PBS-API client, and PBSSnapshot reporting.

- internal/pbs: fingerprint-pinned, token-authed PBS-API client (Verify/Snapshots/
  TaskStatus, node-from-UPID; secret read from /etc/pve/priv/storage/<id>.pw at runtime,
  never logged) + the verify maintenance loop (own cadence, default 6h, NOT gated/journaled,
  like the watchdog) + SnapshotStore.
- hub: PBSSnapshot filled (namespace/type/id/time/size/owner/protected/encrypted/
  verify_state/verify_upid); PBSReporter collector seam; cross-repo golden + bidirectional
  key-set tests; hub handler parses pbs_snapshots + logs a failed-verify WARN.
- backup: report the ACTUAL vzdump mode (parsed from the task log; PVE may downgrade
  snapshot->stop). proxmox.Storage.Username. config PBSVerifyCadence/secret-dir.
  --selftest=pbs-verify. Backup/restore-to-PBS unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/backup/runner.go

@@ -19,6 +19,9 @@ type BackupAPI interface {
 	WaitTask(ctx context.Context, upid string, opts proxmox.WaitOptions) (proxmox.TaskStatus, error)
 	GuestConfig(ctx context.Context, vmid int) (proxmox.GuestConfig, error)
 	StorageContent(ctx context.Context, store string) ([]proxmox.StorageContent, error)
+	// TaskLogTail reads trailing task-log lines — used to read the ACTUAL vzdump mode
+	// (PVE may downgrade a requested snapshot to stop for a stopped guest — spike B1).
+	TaskLogTail(ctx context.Context, upid string, limit int) ([]string, error)
 }
 
 // BackupRunner orchestrates a crash-consistent vzdump to a local target and reports the
@@ -85,6 +88,13 @@ func (r *BackupRunner) Backup(ctx context.Context, vmid int) (hub.Backup, error)
 			rec.DurationSeconds = time.Since(start).Seconds()
 			return rec, fmt.Errorf("backup: vzdump task vmid %d: %w", vmid, err)
 		}
+		// Report the ACTUAL mode PVE used (it may downgrade snapshot→stop for a stopped
+		// guest — spike B1), read from the task log; fall back to the requested mode.
+		if lines, err := r.api.TaskLogTail(ctx, upid, 200); err == nil {
+			if actual := parseBackupMode(lines); actual != "" {
+				rec.Mode = actual
+			}
+		}
 	}
 
 	// Resolve the produced archive (volid + size) — the task status carries no result volid.
@@ -139,6 +149,18 @@ func (r *BackupRunner) latestArchive(ctx context.Context, vmid int) (string, int
 	return vol, size, nil
 }
 
+// parseBackupMode extracts the actual mode from a vzdump task log line `… backup mode: <x>`
+// (e.g. "INFO: backup mode: stop"). Returns "" if not found.
+func parseBackupMode(lines []string) string {
+	const marker = "backup mode:"
+	for _, ln := range lines {
+		if i := strings.Index(ln, marker); i >= 0 {
+			return strings.TrimSpace(ln[i+len(marker):])
+		}
+	}
+	return ""
+}
+
 // uncoveredMountpoints returns the mountpoint paths the guest vzdump EXCLUDES. LXC mount
 // points are OPT-IN to vzdump: a mpN with `backup=1` is covered; ANY other state — the
 // `backup=` token absent OR `backup=0` — is excluded. We deliberately treat unset as