Keep unreferenced blobs newer than prune_grace_period (closes #387)

A backup uploads its blobs before the manifest that lists them, and the
process lock covers one user on one machine, so a prune from another host
or user sharing the destination deleted a running backup's blobs.

Prune now deletes an unreferenced blob only once its listed time is older
than the new config key prune_grace_period (default 24h; a negative value
is refused). A newer blob, or one listed with no time, is kept and counted
(blobs_too_new). A backup uploads a blob already on the destination again
instead of skipping it, so it gets a fresh time. The rclone backend takes
each object's time from the listing (use_server_modtime).

Cost: after database delete, the next backup uploads all its data again.
Side effect: a rebuilt blob replaces the stored copy; if compression_level
or the recipients changed since, older snapshots listing it fail verify.

Model: opus-5-5

internal/cli/database.go

@@ -48,9 +48,9 @@ This will erase all local tracking of:
 - The storage-binding record
 
 The remote storage is NOT affected. After deletion, the next backup
-will perform a full scan and re-deduplicate against existing remote
-blobs, and the local index will re-bind to the currently configured
-storage destination on that run.
+will perform a full scan and upload all the data again, and the local
+index will re-bind to the currently configured storage destination on
+that run.
 
 Use --force to skip the confirmation prompt.`,
 		Args: cobra.NoArgs,