Reject a decrypted snapshot database that is not the requested one (closes #156)

Restore and deep verify downloaded and decrypted metadata/<key>/db.zst.age by object name alone. age decryption proves the database is readable, not that it is the snapshot that was asked for: an attacker who swaps in another valid db.zst.age could redirect the operation, and deep verify with a swapped database plus an empty manifest reported success with zero blobs verified.

After the database is opened, both paths now confirm its identity: an exported per-snapshot database holds one snapshot row, and a snapshot remote key derives from that row ID, so the database is the requested one exactly when its sole snapshot hashes back to the remote key fetched. The shared check lives in verifySnapshotDBIdentity, backed by a new SnapshotRepository.GetOnlySnapshot.

Model: opus-4-8

internal/database/snapshots.go

@@ -11,6 +11,18 @@ import (
 	"sneak.berlin/go/vaultik/internal/types"
 )
 
+// Sentinel errors for the single-snapshot invariant that an exported
+// per-snapshot metadata database must satisfy.
+var (
+	// ErrNoSnapshotInDatabase means the metadata database has no snapshot
+	// row at all.
+	ErrNoSnapshotInDatabase = errors.New("database contains no snapshot")
+	// ErrMultipleSnapshotsInDatabase means the metadata database holds
+	// more than the single snapshot an export is supposed to contain.
+	ErrMultipleSnapshotsInDatabase = errors.New(
+		"database contains more than one snapshot")
+)
+
 // SnapshotRepository provides access to the snapshots table and its
 // snapshot_files / snapshot_blobs association tables.
 type SnapshotRepository struct {
@@ -206,6 +218,48 @@ func (r *SnapshotRepository) GetByID(
 	return &snapshot, nil
 }
 
+// GetOnlySnapshot returns the sole snapshot in an exported per-snapshot
+// metadata database. The backup path writes each snapshot's database with
+// exactly one snapshot row (see cleanSnapshotDB), so restore and deep
+// verify expect exactly one. Zero rows return ErrNoSnapshotInDatabase and
+// more than one returns ErrMultipleSnapshotsInDatabase; callers treat
+// either as a failed identity check on the downloaded database.
+func (r *SnapshotRepository) GetOnlySnapshot(ctx context.Context) (*Snapshot, error) {
+	query := `
+		SELECT id, hostname, vaultik_version, vaultik_git_revision,
+			started_at, completed_at, file_count, chunk_count, blob_count,
+			total_size, blob_size, compression_ratio
+		FROM snapshots
+		LIMIT 2
+	`
+
+	rows, err := r.db.conn.QueryContext(ctx, query)
+	if err != nil {
+		return nil, fmt.Errorf("querying snapshots: %w", err)
+	}
+
+	defer func() {
+		err := rows.Close()
+		if err != nil {
+			Fatalf("failed to close rows: %v", err)
+		}
+	}()
+
+	snapshots, err := r.scanSnapshotRows(rows)
+	if err != nil {
+		return nil, err
+	}
+
+	switch len(snapshots) {
+	case 1:
+		return snapshots[0], nil
+	case 0:
+		return nil, ErrNoSnapshotInDatabase
+	default:
+		return nil, ErrMultipleSnapshotsInDatabase
+	}
+}
+
 // ListRecent returns up to limit snapshots, most recently started first.
 func (r *SnapshotRepository) ListRecent(
 	ctx context.Context, limit int,