Keep unreferenced blobs newer than prune_grace_period (closes #387)

A backup uploads its blobs before the manifest that lists them, and the
process lock covers one user on one machine, so a prune from another host
or user sharing the destination deleted a running backup's blobs.

Prune now deletes an unreferenced blob only once its listed time is older
than the new config key prune_grace_period (default 24h; a negative value
is refused). A newer blob, or one listed with no time, is kept and counted
(blobs_too_new). The rclone backend takes each object's time from the
listing (use_server_modtime).

Decision: a blob a backup reuses from an earlier run that stopped before
its manifest keeps its old time and is not protected; the docs and config
comments say so.

Model: opus-5-5

internal/config/config_test.go

@@ -6,7 +6,6 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
-	"time"
 
 	"sneak.berlin/go/vaultik/internal/chunker"
 	"sneak.berlin/go/vaultik/internal/log"
@@ -451,35 +450,6 @@ func TestValidatePruneGracePeriod(t *testing.T) {
 	}
 }
 
-// TestLoadPruneGracePeriod checks that a config file without
-// prune_grace_period loads with the documented 24h. The value is written out
-// here rather than taken from defaultPruneGracePeriod, so that a change of the
-// default fails this test.
-func TestLoadPruneGracePeriod(t *testing.T) {
-	t.Parallel()
-
-	const withoutGracePeriod = "snapshots:\n" +
-		"  test:\n" +
-		"    paths: [/tmp/vaultik-test-source]\n" +
-		"storage_url: file:///tmp/vaultik-test-storage\n"
-
-	path := filepath.Join(t.TempDir(), "config.yml")
-
-	err := os.WriteFile(path, []byte(withoutGracePeriod), 0o600)
-	if err != nil {
-		t.Fatalf("write config: %v", err)
-	}
-
-	cfg, err := Load(path)
-	if err != nil {
-		t.Fatalf("Load() unexpected error: %v", err)
-	}
-
-	if cfg.PruneGracePeriod != 24*time.Hour {
-		t.Errorf("prune_grace_period = %s, want 24h", cfg.PruneGracePeriod)
-	}
-}
-
 // TestLoadRejectsRelativeFileURL checks that a file:// storage_url with a
 // relative path fails at load. Accepted, it would resolve against the
 // working directory, so a backup run from another directory would write