Phase 2: verify per-user exports, refuse SMB without the native extension, matrix user CI

backup:verify accepts a user export path (users/<uid>/<export>): every blob its manifest references
is checked the same way as for a snapshot, shallow or --deep.

The SMB backend is refused at backup:target:add when the native smbclient PECL extension is not
loaded, instead of registering and then failing the first backup with "Seek failed": with only the
smbclient binary files_external falls back to a shell stream that cannot seek.

The per-user integration job now runs on Nextcloud 32-35, not just 35: it calls user_migration's
internal UserMigrationService, whose API may change between versions.

.github/workflows/ci.yml

@@ -63,19 +63,24 @@ jobs:
 
   integration-user:
     # Per-user backup/restore via user_migration (occ backup:backup:user / backup:restore:user),
-    # an optional dependency installed from the app store. Does not depend on the Nextcloud
-    # version or database beyond what the main integration job already covers, so this runs once.
+    # an optional dependency installed from the app store. It calls user_migration's internal
+    # UserMigrationService, whose API can change between Nextcloud versions, so this runs on every
+    # supported version (not the database, which the main integration job already covers).
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        nextcloud: ['32', '33', '34', '35']
     steps:
       - uses: actions/checkout@v4
       - name: Set up a fresh Nextcloud instance
         run: |
           docker run -d --name ngbu -e SQLITE_DATABASE=nextcloud -e NEXTCLOUD_ADMIN_USER=admin \
             -e NEXTCLOUD_ADMIN_PASSWORD=admin-user-roundtrip -e NEXTCLOUD_TRUSTED_DOMAINS=localhost \
-            -v "$PWD:/var/www/html/custom_apps/ng_backup:ro" nextcloud:35-apache
+            -v "$PWD:/var/www/html/custom_apps/ng_backup:ro" nextcloud:${{ matrix.nextcloud }}-apache
           for i in $(seq 1 90); do docker exec -u www-data ngbu php occ status 2>/dev/null | grep -q "installed: true" && break; sleep 4; done
           docker exec ngbu chown www-data:www-data /var/www/html/custom_apps
-      - name: Per-user backup/restore round trip
+      - name: Per-user backup/restore round trip on Nextcloud ${{ matrix.nextcloud }}
         run: tests/integration/user-roundtrip.sh "docker exec -u www-data ngbu" /var/www/html/data
 
   integration-full-restore: