Add monthly offsite restore tests and automatic cleanup

tests/test_backup.py

@@ -585,7 +585,17 @@ if '--list-only' not in sys.argv and '--exclude=/*' not in sys.argv:
 
     def test_automatic_package_upgrade_and_combined_rollback(self):
         self.enable_report()
-        with self.config.open('a') as f: f.write('MAIL_HOSTNAME="gemini.jr-it-services.de"\n')
+        with self.config.open('a') as f:
+            f.write('MAIL_HOSTNAME="gemini.jr-it-services.de"\nENABLE_RESTORE_TEST=true\nRESTORE_TEST_DB_IMAGE="test-image"\nRESTORE_TEST_MIN_FREE_GB=0\n')
+        # The real isolated DB import is covered separately. Updater preflight
+        # only inspects the prepared local image; it must never pull one.
+        docker=self.bin/'docker'
+        docker.write_text('''#!/usr/bin/env python3
+import json,sys
+assert sys.argv[1:] == ['--host=unix:///var/run/docker.sock','image','inspect','test-image']
+print(json.dumps([{'Id':'sha256:test-image','Config':{'Volumes':{'/var/lib/mysql':{}}}}]))
+''')
+        docker.chmod(0o700)
         canonical=self.configure_upgrade()
         original=canonical.read_bytes()
         package=self.build_package()
@@ -600,6 +610,9 @@ if '--list-only' not in sys.argv and '--exclude=/*' not in sys.argv:
         self.assertIn('MAIL_HOSTNAME="gemini.jr-it-services.de"',canonical.read_text())
         self.assertIn('OK (Inhalt und Abschlussmarker',body)
         self.assertEqual(Path('/usr/local/lib/app-backup/report.py').read_bytes(),(REPO/'lib/report.py').read_bytes())
+        self.assertEqual(Path('/usr/local/lib/app-backup/restore_test.py').read_bytes(),(REPO/'lib/restore_test.py').read_bytes())
+        self.assertTrue(Path('/etc/systemd/system/app-restore-test.timer').is_file())
+        self.assertEqual(json.loads(self.state.read_text())['services']['app-restore-test.timer'],'active')
         self.assertTrue((state/'verified-backup-run').is_file())
         self.assertIn('ENABLE_REMOTE_RETENTION=false',canonical.read_text())
         self.assertEqual(self.cnf.stat().st_mode & 0o777,0o600)