test(backend): DB-backed tests for the risky SQL; test isolation; clippy cleanup

All 40 backend tests were pure-function tests — not one line of SQL ran under `cargo test`,
even though the riskiest code in the repo is SQL. Add 12 DB-backed `#[sqlx::test]` tests
(fresh throwaway DB per test, real migrations) pinning the invariants that code is
load-bearing for, each mutation-verified to fail on broken code:

  export_epoch.rs (8): epoch is post-increment on release (a worker born pre-increment is
    inert); epoch strictly monotonic across reopen; a retired-epoch worker's writes are
    no-ops; export_current is EXACTLY the invariant (8-case table); the ViewerOnly
    carry-forward carries a done ZIP forward AND matches nothing when the ZIP is unfinished
    (the af997a8 strand bug); boot recovery doesn't clobber a live ZIP.
  upload_concurrency.rs (4): the atomic quota UPDATE stops two stale-snapshot uploads from
    both committing (sequential AND concurrent-tx via EPQ); the FOR SHARE upload lock
    serializes against release, blocking a photo from committing after the export snapshot.

Deleting FOR SHARE, or the carry-forward's `status='done'`, each makes a test fail.

Test isolation: TRUNCATE now also resets disk_cache and sse_tickets. The stale disk
reading was harmless only while quotas were globally off in e2e (they no longer are — see
the new quota spec), i.e. two holes were masking each other.

clippy: `cargo clippy --all-targets -- -D warnings` now passes (it did not). Deleted the
dead jobs.rs (an unused BackgroundJob sketch) and unused model methods; `#[allow(dead_code)]`
+ comment on the sqlx FromRow field-sets that ARE populated by the DB. No SQL or logic
changed. `cargo test` requires DATABASE_URL by design.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/models/upload.rs

@@ -3,6 +3,10 @@ use serde::Serialize;
 use sqlx::PgPool;
 use uuid::Uuid;
 
+// Row shape for `upload`: every field is populated by sqlx from `RETURNING *` in `create`. Callers
+// mostly use `id` and hand the rest to the compression/feed queries, so most fields are never read
+// through this struct — they stay here so it keeps mirroring the table.
+#[allow(dead_code)]
 #[derive(Debug, sqlx::FromRow)]
 pub struct Upload {
     pub id: Uuid,
@@ -75,15 +79,6 @@ impl Upload {
         .await
     }
 
-    pub async fn find_by_id(pool: &PgPool, id: Uuid) -> Result<Option<Self>, sqlx::Error> {
-        sqlx::query_as::<_, Self>(
-            "SELECT * FROM upload WHERE id = $1 AND deleted_at IS NULL",
-        )
-        .bind(id)
-        .fetch_optional(pool)
-        .await
-    }
-
     /// Lean lookup for the public media aliases (`get_original`/`get_preview`/
     /// `get_thumbnail`): returns ONLY the file paths + mime for a visible upload —
     /// excluding soft-deleted rows, hidden owners (`uploads_hidden`), and banned owners