v0.6.0: slice 6 Phase B — PBS offsite tier (verify + PBS-API client + reporting)

Spike-proven that backup/restore-to-PBS reuse Phase A unchanged; the only new code is
the verify capability, a small PBS-API client, and PBSSnapshot reporting.

- internal/pbs: fingerprint-pinned, token-authed PBS-API client (Verify/Snapshots/
  TaskStatus, node-from-UPID; secret read from /etc/pve/priv/storage/<id>.pw at runtime,
  never logged) + the verify maintenance loop (own cadence, default 6h, NOT gated/journaled,
  like the watchdog) + SnapshotStore.
- hub: PBSSnapshot filled (namespace/type/id/time/size/owner/protected/encrypted/
  verify_state/verify_upid); PBSReporter collector seam; cross-repo golden + bidirectional
  key-set tests; hub handler parses pbs_snapshots + logs a failed-verify WARN.
- backup: report the ACTUAL vzdump mode (parsed from the task log; PVE may downgrade
  snapshot->stop). proxmox.Storage.Username. config PBSVerifyCadence/secret-dir.
  --selftest=pbs-verify. Backup/restore-to-PBS unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/hub/testdata/host-report.golden.json

@@ -111,7 +111,20 @@
       "duration_seconds": 38.2
     }
   ],
-  "pbs_snapshots": [],
+  "pbs_snapshots": [
+    {
+      "namespace": "root",
+      "backup_type": "ct",
+      "backup_id": "9001",
+      "backup_time": "2026-06-09T14:18:33Z",
+      "size_bytes": 2518889256,
+      "owner": "felhom@pbs!n100",
+      "protected": false,
+      "encrypted": true,
+      "verify_state": "ok",
+      "verify_upid": "UPID:dooplex:00034582:5269BDD7:00000005:6A282176:verify:felhom-spike:felhom@pbs!n100:"
+    }
+  ],
   "cloudflared": { "status": "active" },
   "audit_tail": []
 }