test(review-2): strengthen CR2 export-leak test to drive a real export

The prior test asserted 404 on /media/exports/Gallery.zip against an empty
stack — it would pass even if exports were still written under /media, because
no archive was ever produced. Now it:
  1. seeds an upload, releases the gallery, and polls until the real zip job
     writes Gallery.zip to disk;
  2. asserts the archive is NOT served from public /media (the CR2 leak); and
  3. asserts it IS retrievable via the gated ticket endpoint (200 + PK zip
     magic) — proving the 404 means "not public", not "no file".

Also fixes a test-isolation gap the CR2 relocation introduced: __truncate wiped
media_path but not export_path, so a real export would leave Gallery.zip on disk
and break export.spec's "ready-but-file-missing → 404" test. truncate_all now
purges export_path too. Full 06-export dir: 5/5 green, no contamination.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/handlers/test_admin.rs

@@ -70,6 +70,12 @@ pub async fn truncate_all(
     let _ = tokio::fs::remove_dir_all(&state.config.media_path).await;
     let _ = tokio::fs::create_dir_all(&state.config.media_path).await;
 
+    // Wipe the export directory too. Exports moved OUT of media_path (CR2 fix), so
+    // the media wipe above no longer covers them — without this a real export in
+    // one test would leave Gallery.zip on disk and contaminate the next.
+    let _ = tokio::fs::remove_dir_all(&state.config.export_path).await;
+    let _ = tokio::fs::create_dir_all(&state.config.export_path).await;
+
     // The rate limiter holds an in-memory HashMap; clear it so a previous test's
     // counters don't leak into the next one.
     state.rate_limiter.clear();