feat: a new Minstrel restores a backup, from the web app or the command line, then rescans (#6775)

A new server (no accounts, no library) offers "Restore a backup" beside
"Create account". The file goes up as the request body to
POST /api/auth/restore with the setup token from the log in X-Setup-Token,
since the backup's admins become this server's. It loads in one transaction,
then a library scan starts and finds each file at its path. The same load runs
offline as `minstrel restore FILE`, which migrates the schema first.

That path alone gets a 1 GiB, 15-minute body allowance instead of 4 MiB and
30s, and skips the JSON-only check for cookie writes: a stale cookie from the
old server would otherwise refuse the upload, and the custom header already
rules out a cross-site form.

The library sync answers 410 cursor_ahead to a cursor past the last one the
server has handed out, read from the change sequence, so an app synced with
the old server after the backup was made starts over instead of skipping the
ids the restored server reuses. Restore now leaves each sequence as having
issued the restored maximum, so that reading holds; a compacted log still
counts its handed-out cursors.

backup.Read keeps the underlying error in its chain, so an oversized upload
answers 413 rather than "not a backup". The hosting docs say how to put the
music back first and what is entered again afterwards.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/lib/auth/store.svelte.ts

@@ -1,4 +1,4 @@
-import { api, type User, type LoginResponse } from '#lib/api/client.js';
+import { api, apiFetch, type User, type LoginResponse } from '#lib/api/client.js';
 import { putMyTimezone } from '#lib/api/me.js';
 import { queryClient } from '#lib/query/client.js';
 import { signalSessionEnd } from './sessionEnd.svelte';
@@ -75,6 +75,20 @@ export async function register(opts: {
   void sendTimezoneIfStale();
 }
 
+export type RestoreResult = { accounts: number; scan_started: boolean };
+
+/**
+ * Loads a backup file into a new server, which has no accounts yet. The file
+ * is the request body; the setup token from the server log goes in a header.
+ */
+export async function restoreBackup(file: Blob, setupToken: string): Promise<RestoreResult> {
+  return (await apiFetch('/api/auth/restore', {
+    method: 'POST',
+    body: file,
+    headers: { 'Content-Type': 'application/x-tar', 'X-Setup-Token': setupToken }
+  })) as RestoreResult;
+}
+
 export async function forgotPassword(email: string): Promise<void> {
   await api.post('/api/auth/forgot-password', { email });
 }

web/src/lib/components/auth/RestoreForm.svelte

@@ -0,0 +1,94 @@
+<script lang="ts">
+  import { restoreBackup, type RestoreResult } from '#lib/auth/store.svelte.js';
+  import { errCode } from '#lib/api/errors.js';
+  import { plural } from '#lib/utils/plural.js';
+
+  // A new server can start from a backup instead of a new admin account. It
+  // asks for the same setup token as the first account, since the backup's
+  // admins become this server's.
+
+  let file = $state<File | null>(null);
+  let setupToken = $state('');
+  let restoring = $state(false);
+  let error = $state<string | null>(null);
+  let done = $state<RestoreResult | null>(null);
+
+  function messageFor(code: string): string {
+    switch (code) {
+      case 'setup_token_invalid':
+        return "That setup token doesn't match. Copy it from the server log; it changes each time the server restarts.";
+      case 'not_a_backup':
+        return "That file isn't a Minstrel backup. Choose a minstrel-….tar file from the backup's database folder.";
+      case 'newer_backup':
+        return 'That backup was made by a newer Minstrel. Update this server first, then restore it.';
+      case 'not_empty':
+        return 'This server already has accounts or a library, so it can’t take a backup.';
+      case 'too_large':
+        return 'That file is larger than a backup can be.';
+      default:
+        return 'The restore failed. Please try again.';
+    }
+  }
+
+  async function handleSubmit(e: SubmitEvent) {
+    e.preventDefault();
+    if (restoring || !file) return;
+    error = null;
+    restoring = true;
+    try {
+      done = await restoreBackup(file, setupToken.trim());
+    } catch (err: unknown) {
+      error = messageFor(errCode(err));
+    } finally {
+      restoring = false;
+    }
+  }
+
+  const field = 'w-full rounded border border-border bg-background px-3 py-2 outline-hidden focus:border-accent';
+</script>
+
+{#if done}
+  <div class="space-y-3" role="status" data-testid="restore-done">
+    <p class="text-sm text-text-primary">
+      Restored {plural(done.accounts, 'account', 'accounts')}. Sign in with the password you had.
+    </p>
+    <p class="text-sm text-text-secondary">
+      {done.scan_started
+        ? 'The library scan has started: it finds each music file and fetches the artwork and tags again.'
+        : 'Start a library scan under Admin › Library once you’re signed in.'}
+    </p>
+    <a href="/login" class="block w-full rounded bg-accent px-3 py-2 text-center font-medium text-background">Sign in</a>
+  </div>
+{:else}
+  <form class="space-y-4" onsubmit={handleSubmit}>
+    <label class="block">
+      <span class="mb-1 block text-sm text-text-secondary">Backup file</span>
+      <input
+        type="file"
+        accept=".tar,application/x-tar"
+        required
+        class="{field} text-sm"
+        onchange={(e) => (file = (e.currentTarget as HTMLInputElement).files?.[0] ?? null)}
+      />
+      <span class="mt-1 block text-xs text-text-secondary">
+        A minstrel-….tar file from the backup's database folder. Copy the music back into the library folder first.
+      </span>
+    </label>
+    <label class="block">
+      <span class="mb-1 block text-sm text-text-secondary">Setup token</span>
+      <input type="text" autocomplete="off" spellcheck="false" required class="{field} font-mono" bind:value={setupToken} />
+      <span class="mt-1 block text-xs text-text-secondary">Printed in the server log (look for "setup_token").</span>
+    </label>
+    <button
+      type="submit"
+      class="w-full rounded bg-accent px-3 py-2 font-medium text-background disabled:opacity-60"
+      aria-busy={restoring ? 'true' : undefined}
+      disabled={restoring || !file}
+    >
+      {restoring ? 'Restoring…' : 'Restore'}
+    </button>
+    {#if error}
+      <p role="alert" class="text-sm text-danger">{error}</p>
+    {/if}
+  </form>
+{/if}