v0.6.0: slice 6 Phase B — PBS offsite tier (verify + PBS-API client + reporting)

Spike-proven that backup/restore-to-PBS reuse Phase A unchanged; the only new code is
the verify capability, a small PBS-API client, and PBSSnapshot reporting.

- internal/pbs: fingerprint-pinned, token-authed PBS-API client (Verify/Snapshots/
  TaskStatus, node-from-UPID; secret read from /etc/pve/priv/storage/<id>.pw at runtime,
  never logged) + the verify maintenance loop (own cadence, default 6h, NOT gated/journaled,
  like the watchdog) + SnapshotStore.
- hub: PBSSnapshot filled (namespace/type/id/time/size/owner/protected/encrypted/
  verify_state/verify_upid); PBSReporter collector seam; cross-repo golden + bidirectional
  key-set tests; hub handler parses pbs_snapshots + logs a failed-verify WARN.
- backup: report the ACTUAL vzdump mode (parsed from the task log; PVE may downgrade
  snapshot->stop). proxmox.Storage.Username. config PBSVerifyCadence/secret-dir.
  --selftest=pbs-verify. Backup/restore-to-PBS unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/config/config.go

@@ -47,6 +47,13 @@ type BackupConfig struct {
 	// always excluded. Defaults to 990000–990009.
 	ScratchVMIDMin int `json:"scratch_vmid_min"`
 	ScratchVMIDMax int `json:"scratch_vmid_max"`
+
+	// PBS (slice 6 Phase B). The verify maintenance loop runs on its own cadence (cheaper +
+	// more frequent than the full restore-test); 0 → default (6h), negative → disabled.
+	PBSVerifyCadenceSeconds int `json:"pbs_verify_cadence_seconds"`
+	// PBSSecretDir holds the per-storage PBS token secret files (<id>.pw). Default
+	// /etc/pve/priv/storage (PVE-managed, 0600). The agent reads it at runtime; never logged.
+	PBSSecretDir string `json:"pbs_secret_dir"`
 }
 
 // Default scratch VMID band + restore-test cadence.
@@ -69,6 +76,28 @@ func (b BackupConfig) RestoreTestCadence() time.Duration {
 	}
 }
 
+// PBSVerifyCadence returns the verify-loop interval: positive as-is, 0 → 6h default,
+// negative → 0 (disabled).
+func (b BackupConfig) PBSVerifyCadence() time.Duration {
+	switch {
+	case b.PBSVerifyCadenceSeconds > 0:
+		return time.Duration(b.PBSVerifyCadenceSeconds) * time.Second
+	case b.PBSVerifyCadenceSeconds < 0:
+		return -1 // disabled (pbs.VerifyLoop treats <0 as disabled)
+	default:
+		return 6 * time.Hour
+	}
+}
+
+// PBSSecretPath returns the path to a pbs storage's token-secret file.
+func (b BackupConfig) PBSSecretPath(storageID string) string {
+	dir := b.PBSSecretDir
+	if dir == "" {
+		dir = "/etc/pve/priv/storage"
+	}
+	return dir + "/" + storageID + ".pw"
+}
+
 // ScratchBand returns the effective [min,max] scratch VMID band (defaults applied).
 func (b BackupConfig) ScratchBand() (min, max int) {
 	min, max = b.ScratchVMIDMin, b.ScratchVMIDMax