fix: follow-ups from the 2026-09-23..30 merge review

[MrAlders0n]

Fixes from a review of the PRs merged into dev this week (#149–#185). One commit per fix.

Bugs

• backup: SIGTERM during an admin export left database.sql and pg_service.conf (DB password) in $TMPDIR/beacon-download-* because srv.Shutdown never cancelled the request context. Exports now abort on shutdown (503) and stale staging dirs are swept at startup.
• ingest repeats (feat(ws): opt-in includeRepeats streams later hearings over new paths #178): MarkSent ran after the side effects, so a second broker's copy of the same hearing could be streamed to includeRepeats clients as isRepeat over the path they just received. It now runs right after the insert, unconditionally (so the set is warm before anyone opts in), and never for TRACE, whose path bytes are per-hop SNR.
• MQTT acks (perf(ingest): reduce database work and buffer MQTT bursts #179): sessions are clean with random client IDs, so deferred acks never bought redelivery; they only capped delivery at mosquitto's inflight window and pushed backlog into the broker queue, where drops are silent. Removed.
• profiling (feat: add bounded CPU profiling #182): periodic ticks are offset five minutes from the task tickers so the hourly reconfirm trigger stops being swallowed by the cooldown; any capture clears a deferred periodic; subdirectories in the profile dir no longer stop the recorder; the .json sidecar is published before the .pprof.
• backup verify (feat(backup): verify native archives offline without extraction #160): bytes after the tar terminator or an oversized header are reported as invalid backup archive, not size limit exceeded.
• accounts (feat(admin): add protected account lifecycle endpoints #149): the underlying error is logged on 500.
• route reconfirmation (fix(db): batch route reconfirmation to avoid ingest stalls #180): the ambiguity set (four GROUP BYs over node_short_ids) was recomputed per 1000-route batch, up to 750× a run. It is now fetched once per run and passed to each batch.
• scope importer (feat(scopes): import cached regional MeshMapper catalogues #174): a transient fetch failure retries in five minutes instead of a full refresh interval; a server Retry-After is still honoured as a ceiling.
• scope cache: catalogue imports now invalidate scopes:iatas:* and scope:name:* too, so /scopes stops lagging the filter dropdown by up to an hour.
• until validation (feat(routes): expose bounded retained report evidence #172/fix(observers): provide truthful packet metrics and freshness #169): route evidence and observer activity accept until up to five minutes ahead of server time instead of returning 400 on client clock skew.

API shape

• RouteEvidence no longer carries the dead nextCursor; items, hasMore and nextPageCursor are unchanged on the wire.
• Observer.statusMetadata is emitted as a JSON object instead of a base64 string (beacon-web keeps a base64 fallback for older servers).

CI

• TestPacketSummariesPostgres and the TestReconfirm*Postgres tests are now in the Postgres run; the analytics retention test reads GetSignalStats/GetPathStats on the 039 views.

Follow-up (not in this PR)

Same-observer broker copies that block on each other's ON CONFLICT insert can still race MarkSent; closing that needs the insert to return the stored path.