Keep leases alive during long restores and exports; PR review fixes

Full restore, raw directory restore, per-user export and the safety export
held a fixed-TTL lease on the location that nothing refreshed. A restore or
export running longer than that TTL let a cleanup take over and delete data
still in use. They now refresh the lease while they work (per blob, per row
batch, per written chunk), throttled to once a minute.

Also:
- backup:prune still applies snapshot retention when user-export retention
  fails for a location.
- The recovery kit carries the deletion delay, so a disaster recovery keeps
  the original protection instead of falling back to 7 days. Older kits
  still import with the default.
- CI checkouts no longer persist the token in the git config.
- recoveryKit() has its real return type; the stale baseline entry is gone.

tests/Unit/Service/LeaseThrottleTest.php

@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Tests\Unit\Service;
+
+use OCA\NgBackup\Service\LeaseService;
+use PHPUnit\Framework\TestCase;
+
+final class LeaseThrottleTest extends TestCase {
+	public function testRefreshesOnlyOncePerInterval(): void {
+		$calls = 0;
+		$beat = LeaseService::throttled(function () use (&$calls): void {
+			$calls++;
+		}, 3600);
+		for ($i = 0; $i < 1000; $i++) {
+			$beat();
+		}
+		$this->assertSame(0, $calls, 'no refresh before the interval has passed');
+	}
+
+	public function testRefreshesEveryCallWithZeroInterval(): void {
+		$calls = 0;
+		$beat = LeaseService::throttled(function () use (&$calls): void {
+			$calls++;
+		}, 0);
+		for ($i = 0; $i < 5; $i++) {
+			$beat();
+		}
+		$this->assertSame(5, $calls);
+	}
+}