M5: chained catalog against rollback and hidden snapshots

Every change to the set of snapshots or trash entries writes an
encrypted catalog generation bound to the repository and its position,
with the hash of the previous generation. The server anchors the newest
generation it has seen in its app config; on open, the location must
show at least that generation and chain back to it, and every snapshot
listed must exist. A rolled-back or tampered location is refused (the
run fails and administrators are notified). Opening with the passphrase
on a new server accepts the newest valid chain.

occ backup:target:trust-current accepts a legitimately older state
(e.g. restored from the provider's snapshot) after typing the location
name; audited and announced to all administrators.

Tests: chain advances, rollback, hidden snapshot, swapped generation,
disaster recovery without anchor. Tested on NC34 by deleting the newest
catalog generation on the SFTP location.

lib/Db/AppConfigCatalogAnchor.php

@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Db;
+
+use OCA\NgBackup\AppInfo\Application;
+use OCA\NgBackup\Repository\ICatalogAnchor;
+use OCP\IAppConfig;
+
+/** Keeps the newest catalog generation seen per repository in the app config (outside the location). */
+class AppConfigCatalogAnchor implements ICatalogAnchor {
+	public function __construct(
+		private IAppConfig $appConfig,
+	) {
+	}
+
+	public function get(string $repositoryId): ?array {
+		$raw = $this->appConfig->getValueString(Application::APP_ID, $this->key($repositoryId), '', true);
+		$data = $raw === '' ? null : json_decode($raw, true);
+		return is_array($data) && isset($data['gen'], $data['hash']) ? ['gen' => (int)$data['gen'], 'hash' => (string)$data['hash']] : null;
+	}
+
+	public function set(string $repositoryId, int $gen, string $hash): void {
+		$this->appConfig->setValueString(Application::APP_ID, $this->key($repositoryId), json_encode(['gen' => $gen, 'hash' => $hash]), true);
+	}
+
+	private function key(string $repositoryId): string {
+		return 'catalog_' . preg_replace('/[^a-f0-9]/', '', $repositoryId);
+	}
+}