test(backend): DB-backed tests for the risky SQL; test isolation; clippy cleanup

All 40 backend tests were pure-function tests — not one line of SQL ran under `cargo test`,
even though the riskiest code in the repo is SQL. Add 12 DB-backed `#[sqlx::test]` tests
(fresh throwaway DB per test, real migrations) pinning the invariants that code is
load-bearing for, each mutation-verified to fail on broken code:

  export_epoch.rs (8): epoch is post-increment on release (a worker born pre-increment is
    inert); epoch strictly monotonic across reopen; a retired-epoch worker's writes are
    no-ops; export_current is EXACTLY the invariant (8-case table); the ViewerOnly
    carry-forward carries a done ZIP forward AND matches nothing when the ZIP is unfinished
    (the af997a8 strand bug); boot recovery doesn't clobber a live ZIP.
  upload_concurrency.rs (4): the atomic quota UPDATE stops two stale-snapshot uploads from
    both committing (sequential AND concurrent-tx via EPQ); the FOR SHARE upload lock
    serializes against release, blocking a photo from committing after the export snapshot.

Deleting FOR SHARE, or the carry-forward's `status='done'`, each makes a test fail.

Test isolation: TRUNCATE now also resets disk_cache and sse_tickets. The stale disk
reading was harmless only while quotas were globally off in e2e (they no longer are — see
the new quota spec), i.e. two holes were masking each other.

clippy: `cargo clippy --all-targets -- -D warnings` now passes (it did not). Deleted the
dead jobs.rs (an unused BackgroundJob sketch) and unused model methods; `#[allow(dead_code)]`
+ comment on the sqlx FromRow field-sets that ARE populated by the DB. No SQL or logic
changed. `cargo test` requires DATABASE_URL by design.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/handlers/admin.rs

@@ -98,6 +98,10 @@ pub async fn get_config(
     Ok(Json(rows.into_iter().collect()))
 }
 
+/// Documents the wire shape of `PATCH /admin/config` (a flat `{key: value}` object).
+/// `patch_config` extracts the `HashMap` directly rather than going through this newtype, so it is
+/// never constructed in Rust — it stays as the serde-derived description of the request body.
+#[allow(dead_code)]
 #[derive(Deserialize)]
 pub struct PatchConfigRequest(pub HashMap<String, String>);
 

backend/src/handlers/test_admin.rs

@@ -85,6 +85,19 @@ pub async fn truncate_all(
     // could serve the previous test's toggles.
     state.config_cache.invalidate();
 
+    // The other two in-memory singletons that TRUNCATE used to leave standing.
+    //
+    // `disk_cache` holds a free-space reading for up to its TTL. TRUNCATE has just deleted every
+    // uploaded file, which materially changes free space — so without this the next test can
+    // compute a storage quota from the PREVIOUS test's disk. That was harmless only while quotas
+    // were globally disabled in e2e (they no longer are: see specs/02-upload/quota.spec.ts, which
+    // steers the per-user limit off `free_disk_bytes`), i.e. two holes were masking each other.
+    state.disk_cache.invalidate();
+
+    // `sse_tickets` maps a ticket to a session token hash. TRUNCATE deletes the sessions, so every
+    // surviving ticket is a dangling reference to a user that no longer exists.
+    state.sse_tickets.clear();
+
     Ok(StatusCode::NO_CONTENT)
 }
 

backend/src/handlers/upload.rs

@@ -168,14 +168,14 @@ pub async fn upload(
     // Validate caption length. Counted in chars (code points) to match the
     // "Zeichen" wording in the error message — `.len()` would be bytes and
     // reject perfectly valid German/emoji captions early.
-    if let Some(ref cap) = caption {
-        if cap.chars().count() > MAX_CAPTION_LENGTH {
-            let _ = tokio::fs::remove_file(&temp_abs).await;
-            return Err(AppError::BadRequest(format!(
-                "Beschreibung ist zu lang. Maximum: {} Zeichen.",
-                MAX_CAPTION_LENGTH
-            )));
-        }
+    if let Some(ref cap) = caption
+        && cap.chars().count() > MAX_CAPTION_LENGTH
+    {
+        let _ = tokio::fs::remove_file(&temp_abs).await;
+        return Err(AppError::BadRequest(format!(
+            "Beschreibung ist zu lang. Maximum: {} Zeichen.",
+            MAX_CAPTION_LENGTH
+        )));
     }
 
     // Determine the file type from its magic bytes and require it to be on the
@@ -555,6 +555,9 @@ pub struct QuotaEstimate {
     pub limit_bytes: Option<i64>,
     pub active_uploaders: i64,
     pub free_disk_bytes: i64,
+    /// The tolerance factor the limit above was computed with. Carried on the snapshot so the
+    /// number is self-describing; no caller reads it back today.
+    #[allow(dead_code)]
     pub tolerance: f64,
 }