Phase 2: verify per-user exports, refuse SMB without the native extension, matrix user CI

backup:verify accepts a user export path (users/<uid>/<export>): every blob its manifest references
is checked the same way as for a snapshot, shallow or --deep.

The SMB backend is refused at backup:target:add when the native smbclient PECL extension is not
loaded, instead of registering and then failing the first backup with "Seek failed": with only the
smbclient binary files_external falls back to a shell stream that cannot seek.

The per-user integration job now runs on Nextcloud 32-35, not just 35: it calls user_migration's
internal UserMigrationService, whose API may change between versions.

lib/Service/VerifyService.php

@@ -20,9 +20,18 @@ final class VerifyService {
 
 	/** @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>} */
 	public function verify(Target $target, string $snapshotId, bool $deep = false): array {
+		return $this->run($target, $deep, fn (\OCA\NgBackup\Repository\Repository $repo, callable $heartbeat): array => $repo->verify($snapshotId, $deep, $heartbeat));
+	}
+
+	/** @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>} */
+	public function verifyUserExport(Target $target, string $manifestPath, bool $deep = false): array {
+		return $this->run($target, $deep, fn (\OCA\NgBackup\Repository\Repository $repo, callable $heartbeat): array => $repo->verifyUserExport($manifestPath, $deep, $heartbeat));
+	}
+
+	private function run(Target $target, bool $deep, callable $fn): array {
 		$ttl = $deep ? 600 : 300;
 		try {
-			return $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, $ttl, function (callable $refresh) use ($target, $snapshotId, $deep, $ttl) {
+			return $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, $ttl, function (callable $refresh) use ($target, $deep, $ttl, $fn): array {
 				$last = time();
 				$heartbeat = function () use ($refresh, $ttl, &$last): void {
 					if (time() - $last >= intdiv($ttl, 2)) {
@@ -30,7 +39,7 @@ final class VerifyService {
 						$last = time();
 					}
 				};
-				return $this->targets->repository($target)->verify($snapshotId, $deep, $heartbeat);
+				return $fn($this->targets->repository($target), $heartbeat);
 			});
 		} catch (LockedException) {
 			throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is in progress; try again later');