fix(backup): resolve the restic repository against the live DataDir (agent-os-9au)

[thinkbig1979]

Four handlers resolved their BackupConfig with services.ResolveBackupConfig(db), which called resolveBackupConfig(db, &config.Config{}) — an empty config. With cfg.DataDir == "" the default repository became filepath.Join("", "restic-repo"), i.e. the relative path restic-repo, resolved against the server's working directory (/app).

Every other code path used the service's real config and correctly produced <DataDir>/restic-repo. So init created a repository at /app/restic-repo and reported success, while every backup looked in /app/data/restic-repo and failed.

Observed before the fix

Real container, DATA_DIR=/app/data, no restic_repository setting:

POST /api/v1/backups/repo/init -> {"initialized":true}
log: INFO Initialising restic repository component=restic-manager path=restic-repo
ls /app/restic-repo            -> a valid restic repository   (WRONG location)
ls /app/data/restic-repo       -> did not exist
GET  /api/v1/settings/backup   -> repository=/app/data/restic-repo, repositoryInitialized=false
POST /api/v1/backups/run       -> failed, item durationMs=76

Out of the box — no restic_repository setting, no RESTIC_REPOSITORY env — the UI "Initialise repository" flow could not produce a working backup. /app is also the container's writable layer rather than the data volume, so the repository that was created is destroyed on every container recreation.

Why it was never caught

The four sites — repoInit, cloudTest, listSnapshotsViaRestic, previewSnapshotViaRestic — also constructed their managers with services.NewResticManager / NewRcloneManager directly, bypassing BackupService's factory seam. A test with an injected runner could not reach those paths at all.

The pre-existing TestResolveBackupConfig_ExportedVariantReadsMergedConfig set restic_repository explicitly, so it never exercised the default branch. That is precisely how this survived.

Fix

Both problems have one fix. BackupService gains ResolveConfig, NewResticManager and NewRcloneManager, which resolve against the live config and honour the factory seam. The handlers call those.

The DataDir-less exported ResolveBackupConfig is removed rather than corrected — any resolver that does not take the live config can reintroduce this silently, so the type system now forbids it. A comment at the old site records why.

Tests

Written before the fix and confirmed failing against the old code for the right reason (the injected runner never saw the call at all):

--- FAIL: TestRepoInit_InitialisesRepositoryUnderDataDir
    repoInit must build its ResticManager through the service factory;
    constructing one directly bypasses both the injected runner and the live config
--- FAIL: TestSnapshotListing_ResolvesRepositoryUnderDataDir
    snapshot listing must build its ResticManager through the service factory

Plus two resolver-level guards, including one for the default branch the old test skipped.

Gates

go build and go vet clean; 667 tests pass in 9 packages (663 baseline + 4 added).

Found while running the agent-os-9e1 backup drill, not by reading code. It also clears the way for agent-os-36o's DR drill, which starts from a fresh install and would otherwise hit this immediately.

Closes agent-os-9au.