fix: a restore with pg_restore 17 into Postgres 16 isn't stopped by a setting the server lacks

pg_restore 17 opens with `SET transaction_timeout = 0`, which Postgres 16 refuses.
Under --exit-on-error that one harmless statement ended every restore: the
image ships pg_restore 17.11 and the bundled server is pg16, so a restore
from the bucket (and the local restore) could never have loaded a dump. The
backup round trip, now that CI has pg_dump, found it.

pg_restore now runs to the end and its errors are judged afterwards: the
known harmless one is ignored, and any other fails the restore with that
error's words rather than the "Command was:" line that followed it.

Also sorts an import the lint lane flagged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_backup_restore.py

@@ -198,7 +198,7 @@ def test_a_restore_out_of_time_queues_its_next_chunk(db_sync, tmp_path, run_env,
 def test_a_restart_resumes_the_file_phase_and_drops_the_stale_chunk(
     db_sync, tmp_path, run_env,
 ):
-    from backend.app.tasks.backup import resume_offsite_runs, restore_offsite_task
+    from backend.app.tasks.backup import restore_offsite_task, resume_offsite_runs
     _file(tmp_path, "a.jpg", b"aa")
     _image(db_sync, tmp_path / "a.jpg", b"aa")
     now = datetime.now(UTC)

tests/test_backup_service.py

@@ -173,11 +173,52 @@ def test_restore_db_drops_schema_then_loads(tmp_path, fake_subprocess):
     assert "-c" in fake_subprocess[0]
     assert "DROP SCHEMA IF EXISTS public CASCADE" in fake_subprocess[0][-1]
     assert "pg_terminate_backend" in fake_subprocess[0][-1]
-    assert "pg_restore" in fake_subprocess[1] and "--exit-on-error" in fake_subprocess[1]
+    assert "pg_restore" in fake_subprocess[1]
     assert "-d" in fake_subprocess[1]
     assert str(dump_path) in fake_subprocess[1]
 
 
+def _pg_restore_says(monkeypatch, stderr_text: bytes):
+    class _Done:
+        returncode = 1
+
+    class _Ok:
+        returncode = 0
+
+    def run(cmd, stderr=None, **kw):
+        if "pg_restore" in cmd:
+            stderr.write(stderr_text)
+            return _Done()
+        return _Ok()
+
+    monkeypatch.setattr("subprocess.run", run)
+
+
+_NEWER_CLIENT = (
+    b'pg_restore: error: could not execute query: ERROR:  unrecognized configuration '
+    b'parameter "transaction_timeout"\nCommand was: SET transaction_timeout = 0;\n'
+)
+
+
+def test_a_newer_pg_restore_setting_what_the_server_lacks_is_not_a_failure(
+    tmp_path, monkeypatch,
+):
+    _pg_restore_says(monkeypatch, _NEWER_CLIENT
+                     + b"pg_restore: warning: errors ignored on restore: 1\n")
+    backup_service.restore_db(db_url="postgresql://u@h/d", sql_path=tmp_path / "x.dump")
+
+
+def test_a_real_error_beside_the_harmless_one_fails_the_restore_with_its_words(
+    tmp_path, monkeypatch,
+):
+    _pg_restore_says(monkeypatch, _NEWER_CLIENT
+                     + b'pg_restore: error: could not execute query: ERROR:  relation '
+                       b'"tag" does not exist\nCommand was: COPY tag FROM stdin;\n'
+                     + b"pg_restore: warning: errors ignored on restore: 2\n")
+    with pytest.raises(backup_service.RestoreFailed, match='relation "tag" does not exist'):
+        backup_service.restore_db(db_url="postgresql://u@h/d", sql_path=tmp_path / "x.dump")
+
+
 def test_a_failed_restore_says_what_pg_restore_said(tmp_path, monkeypatch):
     class _Done:
         def __init__(self, code):