v0.6.0: slice 6 Phase B — PBS offsite tier (verify + PBS-API client + reporting)

Spike-proven that backup/restore-to-PBS reuse Phase A unchanged; the only new code is
the verify capability, a small PBS-API client, and PBSSnapshot reporting.

- internal/pbs: fingerprint-pinned, token-authed PBS-API client (Verify/Snapshots/
  TaskStatus, node-from-UPID; secret read from /etc/pve/priv/storage/<id>.pw at runtime,
  never logged) + the verify maintenance loop (own cadence, default 6h, NOT gated/journaled,
  like the watchdog) + SnapshotStore.
- hub: PBSSnapshot filled (namespace/type/id/time/size/owner/protected/encrypted/
  verify_state/verify_upid); PBSReporter collector seam; cross-repo golden + bidirectional
  key-set tests; hub handler parses pbs_snapshots + logs a failed-verify WARN.
- backup: report the ACTUAL vzdump mode (parsed from the task log; PVE may downgrade
  snapshot->stop). proxmox.Storage.Username. config PBSVerifyCadence/secret-dir.
  --selftest=pbs-verify. Backup/restore-to-PBS unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/hub/collect.go

@@ -42,6 +42,12 @@ type RestoreTestReporter interface {
 	RestoreTests(ctx context.Context) []RestoreTest
 }
 
+// PBSReporter is the slice-6-Phase-B seam the pbs verify loop plugs into (same pattern).
+// Returns the agent's latest-known PBS snapshot inventory + verify-state. nil → empty.
+type PBSReporter interface {
+	PBSSnapshots(ctx context.Context) []PBSSnapshot
+}
+
 // Collector builds a HostReport from read-only sources. All deps are behind narrow
 // interfaces for unit testing.
 type Collector struct {
@@ -50,6 +56,7 @@ type Collector struct {
 	storage      StorageObserver
 	backups      BackupReporter
 	restoreTests RestoreTestReporter
+	pbs          PBSReporter
 	hostID       string
 	agentVersion string
 	logger       *slog.Logger
@@ -57,8 +64,8 @@ type Collector struct {
 }
 
 // NewCollector builds a collector. hostID echoes config.Hub.HostID; agentVersion is
-// the binary version. storage/backups/restoreTests may be nil (their collections emit empty).
-func NewCollector(px proxmoxReader, cf CloudflaredProber, storage StorageObserver, backups BackupReporter, restoreTests RestoreTestReporter, hostID, agentVersion string, logger *slog.Logger) *Collector {
+// the binary version. storage/backups/restoreTests/pbs may be nil (their collections emit empty).
+func NewCollector(px proxmoxReader, cf CloudflaredProber, storage StorageObserver, backups BackupReporter, restoreTests RestoreTestReporter, pbs PBSReporter, hostID, agentVersion string, logger *slog.Logger) *Collector {
 	if logger == nil {
 		logger = slog.Default()
 	}
@@ -68,6 +75,7 @@ func NewCollector(px proxmoxReader, cf CloudflaredProber, storage StorageObserve
 		storage:      storage,
 		backups:      backups,
 		restoreTests: restoreTests,
+		pbs:          pbs,
 		hostID:       hostID,
 		agentVersion: agentVersion,
 		logger:       logger,
@@ -96,10 +104,10 @@ func (c *Collector) Collect(ctx context.Context) (*HostReport, error) {
 		StorageTargets: c.collectStorage(ctx),
 		Backups:        c.collectBackups(ctx),
 		RestoreTests:   c.collectRestoreTests(ctx),
-		PBSSnapshots:   []PBSSnapshot{}, // Phase B
+		PBSSnapshots:   c.collectPBSSnapshots(ctx),
 
-		AuditTail:      []AuditEntry{},
-		Cloudflared:    Cloudflared{Status: c.cloudflaredStatus(ctx)},
+		AuditTail:   []AuditEntry{},
+		Cloudflared: Cloudflared{Status: c.cloudflaredStatus(ctx)},
 	}
 	return report, nil
 }
@@ -198,6 +206,17 @@ func (c *Collector) collectRestoreTests(ctx context.Context) []RestoreTest {
 	return []RestoreTest{}
 }
 
+// collectPBSSnapshots reads the latest PBS snapshot inventory via the seam (nil → empty).
+func (c *Collector) collectPBSSnapshots(ctx context.Context) []PBSSnapshot {
+	if c.pbs == nil {
+		return []PBSSnapshot{}
+	}
+	if s := c.pbs.PBSSnapshots(ctx); s != nil {
+		return s
+	}
+	return []PBSSnapshot{}
+}
+
 func (c *Collector) cloudflaredStatus(ctx context.Context) string {
 	if c.cf == nil {
 		return "unknown"