Wire Psalm into CI, fix a real bug it found in user-migration import

RepositoryImportSource::copyToFolder() called putContent() on the generic
return type of Node::get(), which doesn't declare that method -- only
File does. Existing-file overwrite during a per-user restore would have
fatally errored at runtime; added an instanceof check and a resource leak
fix (finally-close) while there. Also guarded getFileAsStream() against
fopen() returning false.

Everything else Psalm (strict level) currently flags is mechanical
(missing `final` on leaf classes -- applied everywhere safe) or pre-existing
array-shape/type gaps, captured in psalm-baseline.xml so CI fails only on
new issues from here on, not the whole backlog at once.

lib/Service/AlertService.php

@@ -15,7 +15,7 @@ use OCP\IGroupManager;
 use OCP\Notification\IManager;
 
 /** Notifies administrators about failed runs and locations without a recent successful backup. */
-class AlertService {
+final class AlertService {
 	public const STALE_AFTER = 2 * 86400;
 
 	public function __construct(

lib/Service/BackupService.php

@@ -28,7 +28,7 @@ use Psr\Log\LoggerInterface;
  * Excluded by default: previews, log files, the updater's backups and each user's cache and
  * temporary uploads (all regenerable or temporary).
  */
-class BackupService {
+final class BackupService {
 	public const KIND_FULL = 'full';
 
 	public function __construct(

lib/Service/KeyService.php

@@ -22,7 +22,7 @@ use OCP\Security\ICrypto;
  *   into the recovery kit, so backups can be restored on a fresh server with the passphrase.
  * - The admin must confirm having stored the recovery kit before the first backup runs.
  */
-class KeyService {
+final class KeyService {
 	private const KEY_MASTER = 'master_key';
 	private const KEY_WRAPPED = 'master_key_wrapped';
 	private const KEY_CONFIRMED = 'recovery_kit_confirmed';

lib/Service/KeySlotService.php

@@ -13,7 +13,7 @@ namespace OCA\NgBackup\Service;
  * is written to all locations and announced to all administrators; a new recovery kit must be
  * downloaded and confirmed afterwards (backups keep running meanwhile).
  */
-class KeySlotService {
+final class KeySlotService {
 	public function __construct(
 		private KeyService $keys,
 		private TargetService $targets,

lib/Service/LeaseService.php

@@ -19,7 +19,7 @@ use OCP\Lock\LockedException;
  * holder keeps refreshing it. Nextcloud's lock is only held for the few milliseconds in which a
  * lease is checked and written.
  */
-class LeaseService {
+final class LeaseService {
 	public const SHARED = 's';
 	public const EXCLUSIVE = 'x';
 

lib/Service/PruneService.php

@@ -20,7 +20,7 @@ use OCP\Lock\LockedException;
  * prunes data no remaining snapshot uses. Never runs on append-only locations, never while a
  * backup to the same location is running (the location lock is shared with BackupService).
  */
-class PruneService {
+final class PruneService {
 	public function __construct(
 		private TargetService $targets,
 		private RunMapper $runs,

lib/Service/RestoreService.php

@@ -28,7 +28,7 @@ use OCP\Files\NotFoundException;
  *  - merge:   into the original place, existing files are overwritten (old content kept as a version)
  *  - replace: like merge, and files that are not in the snapshot are moved to the trash
  */
-class RestoreService {
+final class RestoreService {
 	public const MODE_NEW_FOLDER = 'new-folder';
 	public const MODE_MERGE = 'merge';
 	public const MODE_REPLACE = 'replace';

lib/Service/TargetService.php

@@ -22,7 +22,7 @@ use OCP\Server;
  * object is built only while it is used; nothing is mounted. files_external is loaded for its
  * classes but its enabled/disabled state is left as the admin set it.
  */
-class TargetService {
+final class TargetService {
 	public function __construct(
 		private TargetMapper $mapper,
 		private KeyService $keys,