// Package pbs is the agent's PBS (Proxmox Backup Server) API client + the verify
// maintenance loop (doc 03 §8, slice 6 Phase B).
//
// PBS is a SEPARATE server (its own host:8007, its own API + token auth), distinct from the
// PVE proxmox.Client — so this is the agent's SECOND privileged external surface and gets the
// same slice-1 discipline: TLS fingerprint-pinned to the PBS leaf cert, token auth, typed,
// context-aware, NO shell.
//
// The spike (felhom.eu/documentation/tests/phase5-pbs-spike-findings.md) proved that
// backup-to-PBS and restore-from-PBS reuse Phase A UNCHANGED (PBS is just a storage target +
// a volid). The only genuinely new code here is:
//   - client.go  — the PBS-API client: Verify, Snapshots, TaskStatus (node from the UPID).
//   - report.go  — Snapshot → hub.PBSSnapshot mapping + a SnapshotStore implementing the hub
//     PBSReporter seam (the collector reads it; hub does not import pbs).
//   - verify.go  — the verify maintenance loop on its OWN cadence (the cheap, frequent,
//     ciphertext-level integrity check — needs NO encryption key, unlike the
//     full self-restore-test). It is a reporting/maintenance task like the
//     slice-5 watchdog: it does NOT go through the reconcile gate/journal.
//
// The encryption key is never needed here (verify is ciphertext-level), and the token secret
// is read at runtime from /etc/pve/priv/storage/<id>.pw — referenced by location, never
// logged or committed (zero-knowledge holds; the PBS server has no client key — spike B6).
package pbs