Refuse an exclude pattern that does not compile at config load (closes #455)

An exclude pattern that did not compile was skipped with a warning during the backup, which then stored what the user meant to leave out. Config.Validate now refuses it, naming the setting and quoting the pattern, for example exclude[2]: "build[" is not a valid exclude pattern: ...

The compile step moves to a new package, internal/exclude, as exclude.Compile; Validate and the scanner both call it. The scanner's skip-and-warn path is gone; a pattern that does not compile there now fails the scanner.

Model: opus-5-5

internal/config/exclude_test.go

@@ -0,0 +1,65 @@
+package config_test
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"sneak.berlin/go/vaultik/internal/config"
+)
+
+// TestLoadRefusesBadExcludePattern checks that an exclude pattern that does
+// not compile, global or in a snapshot, fails at load with the setting and
+// the pattern named, rather than the backup storing what it meant to leave
+// out.
+func TestLoadRefusesBadExcludePattern(t *testing.T) {
+	t.Parallel()
+
+	const storage = "storage_url: file:///tmp/vaultik-test-storage\n"
+
+	tests := []struct {
+		name    string
+		config  string
+		wantErr string
+	}{
+		{
+			name: "global",
+			config: "exclude: ['*.tmp', '.cache', 'build[']\n" +
+				"snapshots:\n" +
+				"  home:\n" +
+				"    paths: [/tmp/vaultik-test-source]\n" + storage,
+			wantErr: `exclude[2]: "build[" is not a valid exclude pattern`,
+		},
+		{
+			name: "snapshot",
+			config: "snapshots:\n" +
+				"  home:\n" +
+				"    paths: [/tmp/vaultik-test-source]\n" +
+				"    exclude: ['/a/**/x[']\n" + storage,
+			wantErr: `snapshots.home.exclude[0]: "/a/**/x[" is not a valid exclude pattern`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			path := filepath.Join(t.TempDir(), "config.yml")
+
+			err := os.WriteFile(path, []byte(tt.config), 0o600)
+			if err != nil {
+				t.Fatalf("write config: %v", err)
+			}
+
+			_, err = config.Load(path)
+			if err == nil {
+				t.Fatalf("Load() returned nil, want an error containing %q", tt.wantErr)
+			}
+
+			if !strings.Contains(err.Error(), tt.wantErr) {
+				t.Fatalf("Load() error = %q, want it to contain %q", err, tt.wantErr)
+			}
+		})
+	}
+}