P2.2-P2.9, P3.2-P3.10, P4.1-P4.3: Complete Phases 2, 3, and 4

11 work units built in parallel and merged:

Agent handlers (Phase 2):
- P2.2 Deploy: pull images, stop/remove/run containers, update registry
- P2.3 Lifecycle: stop/start/restart with desired_state tracking
- P2.4 Status: list (registry), live check (runtime), get status (drift+events)
- P2.5 Sync: receive desired state, reconcile unmanaged containers
- P2.6 File transfer: push/pull scoped to /srv/<service>/, path validation
- P2.7 Adopt: match <service>-* containers, derive component names
- P2.8 Monitor: continuous watch loop, drift/flap alerting, event pruning
- P2.9 Snapshot: VACUUM INTO database backup command

CLI commands (Phase 3):
- P3.2 Login, P3.3 Deploy, P3.4 Stop/Start/Restart
- P3.5 List/Ps/Status, P3.6 Sync, P3.7 Adopt
- P3.8 Service show/edit/export, P3.9 Push/Pull, P3.10 Node list/add/remove

Deployment artifacts (Phase 4):
- Systemd units (agent service + backup timer)
- Example configs (CLI + agent)
- Install script (idempotent)

All packages: build, vet, lint (0 issues), test (all pass).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/mcp-agent/snapshot.go

@@ -0,0 +1,48 @@
+package main
+
+import (
+	"database/sql"
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	"git.wntrmute.dev/kyle/mcp/internal/config"
+	"github.com/spf13/cobra"
+	_ "modernc.org/sqlite"
+)
+
+func snapshotCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "snapshot",
+		Short: "Create a database backup",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			cfg, err := config.LoadAgentConfig(cfgPath)
+			if err != nil {
+				return fmt.Errorf("load config: %w", err)
+			}
+
+			backupDir := filepath.Join(filepath.Dir(cfg.Database.Path), "backups")
+			if err := os.MkdirAll(backupDir, 0750); err != nil {
+				return fmt.Errorf("create backup dir: %w", err)
+			}
+
+			ts := time.Now().Format("20060102-150405")
+			backupPath := filepath.Join(backupDir, fmt.Sprintf("mcp-%s.db", ts))
+
+			db, err := sql.Open("sqlite", cfg.Database.Path)
+			if err != nil {
+				return fmt.Errorf("open database: %w", err)
+			}
+			defer func() { _ = db.Close() }()
+
+			//nolint:gosec // backupPath is derived from config + timestamp, not user input; VACUUM INTO does not support placeholders
+			if _, err := db.Exec("VACUUM INTO '" + backupPath + "'"); err != nil {
+				return fmt.Errorf("vacuum into: %w", err)
+			}
+
+			fmt.Printf("snapshot: %s\n", backupPath)
+			return nil
+		},
+	}
+}