fix(restore): harden restore checks and add authelia smoke scaffold

ops/restore-tests/paperless-restore-test.sh

@@ -41,8 +41,14 @@ require_cmd curl
 require_path "$BORG_PASSPHRASE_FILE_DEFAULT"
 require_path "$COMPOSE_FILE"
 
+RESTORE_SUCCESS=0
 cleanup() {
   cleanup_compose "$COMPOSE_FILE"
+  if [ "$RESTORE_SUCCESS" -ne 1 ]; then
+    preserve_on_failure "paperless" "$RESTORE_ROOT"
+    rm -rf "$EXTRACT_DIR"
+    return
+  fi
   if [ "$KEEP_DATA" -ne 1 ]; then
     rm -rf "$RESTORE_ROOT"
   fi
@@ -70,7 +76,30 @@ mv "$EXTRACT_DIR/local/borg-dumps/latest/postgresql17-paperless.dump" "$RESTORE_
 
 docker compose -f "$COMPOSE_FILE" up -d restoretest-paperless-postgres restoretest-paperless-redis >/dev/null
 until docker exec restoretest-paperless-postgres pg_isready -U paperless -d paperless >/dev/null 2>&1; do sleep 2; done
-cat "$RESTORE_ROOT/dumps/latest/postgresql17-paperless.dump" | docker exec -i restoretest-paperless-postgres pg_restore -U paperless -d paperless --clean --if-exists --no-owner --no-privileges
+
+# Postgres-Entrypoint kann kurz nach "ready" noch vom Init- auf den finalen
+# Server wechseln. pg_restore toleriert transiente Start-/Shutdown-Fehler und
+# retried; harte Fehler (z. B. Dump-Korruption) brechen wie bisher ab.
+restore_ok=0
+for attempt in $(seq 1 12); do
+  if docker exec -i restoretest-paperless-postgres \
+    pg_restore -U paperless -d paperless --clean --if-exists --no-owner --no-privileges \
+    < "$RESTORE_ROOT/dumps/latest/postgresql17-paperless.dump" 2>/tmp/paperless-pg-restore.err; then
+    restore_ok=1
+    break
+  fi
+  if grep -qiE "starting up|shutting down|connection refused|database .* does not exist" /tmp/paperless-pg-restore.err; then
+    sleep 5
+    continue
+  fi
+  cat /tmp/paperless-pg-restore.err >&2
+  exit 1
+done
+
+if [ "$restore_ok" -ne 1 ]; then
+  cat /tmp/paperless-pg-restore.err >&2
+  exit 1
+fi
 
 docker compose -f "$COMPOSE_FILE" up -d restoretest-paperless >/dev/null
 sleep 12
@@ -110,4 +139,5 @@ write_report "$REPORT_FILE" <<EOF
 - Test data was cleaned after success: \`$([ "$KEEP_DATA" -eq 1 ] && echo no || echo yes)\`
 EOF
 
+RESTORE_SUCCESS=1
 echo "Paperless restore test ok -> $REPORT_FILE"