Phase 8: back up & restore remote (agent) stacks (0.8.0)

- Agent: GET /agent/stacks/{id}/backup + POST /agent/stacks/restore (reuse
  backup_service). backup_service gains backup_basename/backup_filename helpers.
- Main proxy streams agent <-> main <-> destination (creds stay central):
  agent_service download_to_file/upload_file; routers/agents.py backup download,
  backup/push, restore upload, restore-from.
- Schedules: BackupSchedule.agent_id; schedule_service downloads from the agent
  when set; per-host filename prefix isolates retention across hosts.
- Frontend: agents api backup/restore; BackupButton/RestoreButton agent-aware
  (Backup on remote stack detail, Restore per host section); schedule form host
  selector (local or an online agent) + host shown on schedule rows.

Rough-verified (per request): py_compile, frontend tsc build, image imports
(main 99 / agent 16 routes). Full live agent round-trip to be tested post-deploy.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/components/stacks/AgentStacksSection.tsx

@@ -4,6 +4,7 @@ import { Server } from "lucide-react";
 import { toast } from "sonner";
 import { Card } from "@/components/ui";
 import { StackCard } from "@/components/stacks/StackCard";
+import { RestoreButton } from "@/components/stacks/BackupRestore";
 import { HostDot } from "@/components/hosts/HostDot";
 import { agentsApi } from "@/api/agents";
 import { apiErrorMessage } from "@/api/client";
@@ -37,14 +38,17 @@ export function AgentStacksSection({ agent, isAdmin }: { agent: Agent; isAdmin:
 
   return (
     <section>
-      <h2 className="mb-3 flex items-center gap-2 text-sm font-semibold uppercase tracking-wide text-slate-500">
-        <Server className="h-4 w-4" />
-        {agent.name}
-        <HostDot status={agent.status} />
-        {agent.hostname && (
-          <span className="font-mono text-xs normal-case text-slate-400">{agent.hostname}</span>
-        )}
-      </h2>
+      <div className="mb-3 flex items-center justify-between gap-2">
+        <h2 className="flex items-center gap-2 text-sm font-semibold uppercase tracking-wide text-slate-500">
+          <Server className="h-4 w-4" />
+          {agent.name}
+          <HostDot status={agent.status} />
+          {agent.hostname && (
+            <span className="font-mono text-xs normal-case text-slate-400">{agent.hostname}</span>
+          )}
+        </h2>
+        {isAdmin && online && <RestoreButton agentId={agent.id} />}
+      </div>
 
       {!online ? (
         <Card>

frontend/src/components/stacks/BackupRestore.tsx

@@ -4,6 +4,7 @@ import { Archive, Upload } from "lucide-react";
 import { toast } from "sonner";
 import { Button } from "@/components/ui";
 import { backupsApi, destinationsApi } from "@/api/backups";
+import { agentsApi } from "@/api/agents";
 import { apiErrorMessage } from "@/api/client";
 import { formatBytes } from "@/lib/utils";
 
@@ -50,7 +51,13 @@ function Modal({ children, onClose }: { children: React.ReactNode; onClose: () =
   );
 }
 
-export function BackupButton({ stackId }: { stackId: string }) {
+export function BackupButton({
+  stackId,
+  agentId,
+}: {
+  stackId: string;
+  agentId?: number;
+}) {
   const [open, setOpen] = useState(false);
   const [includeVolumes, setIncludeVolumes] = useState(true);
   const [stopFirst, setStopFirst] = useState(true);
@@ -68,14 +75,22 @@ export function BackupButton({ stackId }: { stackId: string }) {
     const tid = toast.loading("Creating backup…");
     try {
       if (target === "download") {
-        await backupsApi.download(stackId, { includeVolumes, stopFirst });
+        if (agentId != null) {
+          await agentsApi.backupDownload(agentId, stackId, { includeVolumes, stopFirst });
+        } else {
+          await backupsApi.download(stackId, { includeVolumes, stopFirst });
+        }
         toast.success("Backup downloaded", { id: tid });
       } else {
-        const res = await backupsApi.push(stackId, {
+        const body = {
           destination_id: Number(target),
           include_volumes: includeVolumes,
           stop_first: stopFirst,
-        });
+        };
+        const res =
+          agentId != null
+            ? await agentsApi.backupPush(agentId, stackId, body)
+            : await backupsApi.push(stackId, body);
         toast.success(`Backup pushed to ${res.destination}`, { id: tid });
       }
       setOpen(false);
@@ -133,7 +148,7 @@ export function BackupButton({ stackId }: { stackId: string }) {
   );
 }
 
-export function RestoreButton() {
+export function RestoreButton({ agentId }: { agentId?: number }) {
   const qc = useQueryClient();
   const [open, setOpen] = useState(false);
   const [mode, setMode] = useState<"upload" | "destination">("upload");
@@ -167,27 +182,31 @@ export function RestoreButton() {
           setBusy(false);
           return;
         }
-        res = await backupsApi.restore(file, {
-          targetId: targetId.trim() || undefined,
-          overwrite,
-          restoreVolumes,
-        });
+        const opts = { targetId: targetId.trim() || undefined, overwrite, restoreVolumes };
+        res =
+          agentId != null
+            ? await agentsApi.restoreUpload(agentId, file, opts)
+            : await backupsApi.restore(file, opts);
       } else {
         if (!destId || !remoteName) {
           toast.error("Pick a destination and a backup", { id: tid });
           setBusy(false);
           return;
         }
-        res = await backupsApi.restoreFrom({
+        const body = {
           destination_id: Number(destId),
           name: remoteName,
           target_id: targetId.trim() || undefined,
           overwrite,
           restore_volumes: restoreVolumes,
-        });
+        };
+        res =
+          agentId != null
+            ? await agentsApi.restoreFrom(agentId, body)
+            : await backupsApi.restoreFrom(body);
       }
       toast.success(`Restored '${res.stack_id}' (${res.volumes_restored} volume(s))`, { id: tid });
-      qc.invalidateQueries({ queryKey: ["stacks"] });
+      qc.invalidateQueries({ queryKey: agentId != null ? ["agent-stacks", agentId] : ["stacks"] });
       setOpen(false);
       setFile(null);
       setTargetId("");