refactor: retire the images tarball backup

Images and attachments are backed up off-site, one object per file, so the
tar+zstd of /images goes: its service and restore, both tasks, the trigger and
restore routes, the Keep last setting, the screen's Images section, and the
tests. Migration 0122 drops backup_run.tar_path and
import_settings.backup_images_keep_last_n and deletes any images runs.

The local database dump stays for an install with no off-site destination,
and the Backups card now says plainly that images and attachments are backed
up only off-site.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_backup_service.py

@@ -1,6 +1,6 @@
 """FC-3h: backup_service unit tests.
 
-Subprocess calls (pg_dump, tar, psql) are monkeypatched so tests run
+Subprocess calls (pg_dump, pg_restore, psql) are monkeypatched so tests run
 without external binaries. The real subprocess behavior is exercised
 implicitly via the Celery task tests in test_tasks_backup.py.
 """
@@ -32,9 +32,6 @@ def fake_subprocess(monkeypatch):
         if "pg_dump" in cmd:
             i = cmd.index("-f")
             Path(cmd[i + 1]).write_bytes(b"-- fake pg_dump\n")
-        elif cmd[0] == "tar" and "-cf" in cmd:
-            i = cmd.index("-cf")
-            Path(cmd[i + 1]).write_bytes(b"fake tar payload")
 
     def _fake_run(cmd, **kwargs):
         calls.append(list(cmd))
@@ -100,7 +97,6 @@ def test_backup_db_writes_sql_and_manifest(tmp_path, fake_subprocess):
     assert sql.is_file() and sql.suffix == ".dump"
     assert manifest.is_file() and manifest.suffix == ".json"
     assert result["kind"] == "db"
-    assert result["tar_path"] is None
     assert result["size_bytes"] == len(b"-- fake pg_dump\n")
 
     parsed = json.loads(manifest.read_text())
@@ -141,50 +137,6 @@ def test_backup_db_default_tag_is_none(tmp_path, fake_subprocess):
     assert parsed["tag"] is None
 
 
-# --- backup_images ---------------------------------------------------
-
-
-def test_backup_images_writes_tar_and_manifest(tmp_path, fake_subprocess):
-    result = backup_service.backup_images(
-        images_root=tmp_path, tag="monthly", triggered_by="manual",
-    )
-    tar = Path(result["tar_path"])
-    assert tar.is_file() and tar.name.endswith(".tar.zst")
-    assert result["sql_path"] is None
-    assert result["size_bytes"] == len(b"fake tar payload")
-
-
-def test_backup_images_excludes_backups_and_quarantine(tmp_path, fake_subprocess):
-    backup_service.backup_images(images_root=tmp_path)
-    cmd = fake_subprocess[0]
-    excludes = [arg for arg in cmd if arg.startswith("--exclude=")]
-    assert any("_backups" in e for e in excludes)
-    assert any("_quarantine" in e for e in excludes)
-
-
-def test_backup_images_excludes_credentials(tmp_path, fake_subprocess):
-    """#4234: the images tarball carried `secrets/credential_key.b64` — the key
-    that decrypts the stored session cookies — and `cookies/` itself. A media
-    archive must not be a credential leak; encryption at rest is worth nothing
-    if the key travels with the data."""
-    backup_service.backup_images(images_root=tmp_path)
-    excludes = [a for a in fake_subprocess[0] if a.startswith("--exclude=")]
-    assert any(e.endswith("/secrets") for e in excludes)
-    assert any(e.endswith("/cookies") for e in excludes)
-
-
-def test_backup_images_excludes_are_root_relative(tmp_path, fake_subprocess):
-    """tar matches --exclude against the archived path, which is prefixed with
-    the root's own directory name (`-C <parent> <name>`). A bare `secrets`
-    would also match an ARTIST folder called secrets; the prefix is what keeps
-    the exclusion to the top level."""
-    backup_service.backup_images(images_root=tmp_path)
-    excludes = [a for a in fake_subprocess[0] if a.startswith("--exclude=")]
-    assert excludes and all(
-        e.startswith(f"--exclude={tmp_path.name}/") for e in excludes
-    )
-
-
 # --- restore_db ------------------------------------------------------
 
 
@@ -267,41 +219,25 @@ def test_every_dump_leaves_out_account_logins(tmp_path, fake_subprocess):
     assert "--exclude-table-data=credential" in fake_subprocess[0]
 
 
-# --- restore_images --------------------------------------------------
-
-
-def test_restore_images_untar_to_parent(tmp_path, fake_subprocess):
-    tar_path = tmp_path / "fake.tar.zst"
-    tar_path.write_bytes(b"fake")
-    backup_service.restore_images(images_root=tmp_path, tar_path=tar_path)
-    cmd = fake_subprocess[0]
-    assert cmd[:3] == ["tar", "--zstd", "-xf"]
-    assert str(tar_path) in cmd
-    assert "-C" in cmd
-
-
 # --- unlink ----------------------------------------------------------
 
 
 def test_unlink_removes_present_files_and_reports(tmp_path):
     sql = tmp_path / "x.sql"
     sql.write_bytes(b"x")
-    tar = tmp_path / "x.tar.zst"
-    tar.write_bytes(b"x")
     manifest = tmp_path / "x.json"
     manifest.write_text("{}")
     result = backup_service.unlink_artifact_files(
-        sql_path=str(sql), tar_path=str(tar), manifest_path=str(manifest),
+        sql_path=str(sql), manifest_path=str(manifest),
     )
-    assert result == {"sql": True, "tar": True, "manifest": True}
-    assert not sql.exists() and not tar.exists() and not manifest.exists()
+    assert result == {"sql": True, "manifest": True}
+    assert not sql.exists() and not manifest.exists()
 
 
 def test_unlink_missing_files_returns_true(tmp_path):
     """missing_ok semantics: a non-existent file isn't an error."""
     result = backup_service.unlink_artifact_files(
-        sql_path=str(tmp_path / "nope.sql"),
-        tar_path=None, manifest_path=None,
+        sql_path=str(tmp_path / "nope.sql"), manifest_path=None,
     )
     assert result == {"sql": True}
 
@@ -309,7 +245,7 @@ def test_unlink_missing_files_returns_true(tmp_path):
 def test_unlink_skips_none_paths():
     """A None path is skipped — not added to the result dict."""
     result = backup_service.unlink_artifact_files(
-        sql_path=None, tar_path=None, manifest_path=None,
+        sql_path=None, manifest_path=None,
     )
     assert result == {}