CI: round trip against real S3 and SFTP backends, not just a local path

Added tests/integration/targets-matrix.sh, which runs the full backup/restore
round trip through files_external's AmazonS3 and SFTP backend classes (S3
via a disposable s3mock container, SFTP via atmoz/sftp), since the existing
matrix only ever exercised the local backend.

This caught a real bug: moving a snapshot to the trash read it from the
location and streamed it straight back into a write on the same connection,
which SFTP can't do reliably (phpseclib fails to interleave a read and a
write on one connection). Backends now expose a native move() and the
id-bound snapshot object is moved with that instead of a read+write copy;
the path-bound database dump still goes through decrypt/re-encrypt, since
its AEAD authentication is tied to its path.

tests/integration/roundtrip.sh

@@ -1,9 +1,12 @@
 #!/bin/bash
 # End-to-end round trip of NG Backup inside a Nextcloud installation (CI and local matrix).
-# Usage: roundtrip.sh "<command prefix to run occ/php as the web user in the instance>" <datadir> <apps-path>
+# Usage: roundtrip.sh "<command prefix to run occ/php as the web user in the instance>" <datadir> <apps-path> [target-args]
 #   e.g. roundtrip.sh "docker exec -u www-data ngb-nc35-pgsql" /var/www/html/data /var/www/html/custom_apps
+#   target-args defaults to a local files_external location; pass backend/auth/options to exercise
+#   a different backend (e.g. amazons3 or sftp), see tests/integration/targets-matrix.sh.
 set -euo pipefail
 X="$1"; DATA="$2"; APPS="$3"
+TARGET_ARGS="${4:-local -a null::null -o datadir=/tmp/ngb-rt-target}"
 occ() { $X php occ "$@"; }
 fail() { echo "FAIL: $*"; exit 1; }
 ok() { echo "ok   $*"; }
@@ -17,8 +20,8 @@ CODE=$(occ backup:key:kit | php -r 'echo json_decode(stream_get_contents(STDIN),
 occ backup:key:confirm -u admin --code="$CODE" --confirm="Yes, I confirm" >/dev/null || fail "confirm"
 ok "key, kit code and confirmation"
 
-occ backup:target:add ci local -a null::null -o datadir=/tmp/ngb-rt-target --path=repo >/dev/null || fail "target add"
-ok "local location added"
+occ backup:target:add ci $TARGET_ARGS --path=repo >/dev/null || fail "target add"
+ok "location added"
 
 # Test data: a user with files.
 $X sh -c "OC_PASS='Roundtrip-pw-2026' php occ user:add --password-from-env $U >/dev/null"