Run the local index in WAL mode with a busy timeout (closes #217)

The connection settings were passed as `_journal_mode=`-style
parameters, which the SQLite driver drops without an error, so the
index ran in rollback-journal mode with no busy timeout. `snapshot
list` or `info` reading during a backup could make the backup's next
write fail with "database is locked". Both open paths now pass
`_pragma=` parameters; foreign keys moved there too.

With WAL on, rows committed to the open index can still be in the
-wal file, which a copy of the main file misses. The metadata export
now copies the index with VACUUM INTO, into an empty 0600 file.

The retry after a failed open no longer claims a TRUNCATE recovery; it
retries with the same settings.

Model: opus-5-5

internal/snapshot/snapshot_test.go

@@ -188,6 +188,77 @@ func TestVacuumDatabaseRemovesDeletedData(t *testing.T) {
 	}
 }
 
+// TestPrepareExportDBKeepsRowsCommittedToOpenIndex exports from an index
+// that is still open, as a backup does. A row committed there can still be
+// in the index's -wal file, and the export must hold it all the same.
+func TestPrepareExportDBKeepsRowsCommittedToOpenIndex(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	ctx := context.Background()
+	fs := afero.NewOsFs()
+
+	dbPath := filepath.Join(t.TempDir(), "index.sqlite")
+
+	db, err := database.New(ctx, dbPath)
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+
+	defer func() { _ = db.Close() }()
+
+	repos := database.NewRepositories(db)
+
+	snapshot := &database.Snapshot{ID: "open-index-snapshot", Hostname: "test-host"}
+
+	err = repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
+		return repos.Snapshots.Create(ctx, tx, snapshot)
+	})
+	if err != nil {
+		t.Fatalf("failed to create snapshot: %v", err)
+	}
+
+	sm := &SnapshotManager{
+		config: &config.Config{
+			CompressionLevel: 3,
+			AgeRecipients:    []string{testAgeRecipient},
+		},
+		fs: fs,
+	}
+
+	_, tempDBPath, err := sm.prepareExportDB(
+		ctx, dbPath, snapshot.ID.String(), t.TempDir())
+	if err != nil {
+		t.Fatalf("prepareExportDB failed: %v", err)
+	}
+
+	// Only the main database file is compressed and uploaded, so open a
+	// copy of that file alone.
+	uploadedPath := filepath.Join(t.TempDir(), "uploaded.db")
+
+	err = copyFile(fs, tempDBPath, uploadedPath)
+	if err != nil {
+		t.Fatalf("failed to copy exported database: %v", err)
+	}
+
+	exported, err := database.OpenReadOnly(ctx, uploadedPath)
+	if err != nil {
+		t.Fatalf("failed to open exported database: %v", err)
+	}
+
+	defer func() { _ = exported.Close() }()
+
+	got, err := database.NewRepositories(exported).Snapshots.GetByID(
+		ctx, snapshot.ID.String())
+	if err != nil {
+		t.Fatalf("failed to read snapshot from export: %v", err)
+	}
+
+	if got == nil {
+		t.Fatal("exported database is missing the snapshot row")
+	}
+}
+
 func TestCleanSnapshotDBEmptySnapshot(t *testing.T) {
 	// Initialize logger
 	log.Initialize(log.Config{})