Fix review findings: catalog writes, user restore consent, retention validation

Catalog: forgetting a user export or purging trash now writes the catalog
before deleting the objects, so a crash leaves at most an unreferenced file
instead of a catalog entry pointing at nothing. Per-user backup and the
safety export reopen the repository inside the catalog lock, so they build
on the latest catalog generation.

Commands: backup:user:backup and backup:user:restore resolve the location
before asking to install user_migration, and a successful install always
stops with a rerun instruction. backup:retention rejects a malformed
--user-last before changing any policy. backup:key:import fails clearly
when the passphrase file cannot be read.

lib/Command/BackupUser.php

@@ -51,8 +51,8 @@ HELP);
 			return 1;
 		}
 		try {
-			$this->installer->ensureEnabled($input, $output);
 			$target = $this->targets->get($input->getArgument('target'));
+			$this->installer->ensureEnabled($input, $output);
 			$manifest = $this->userBackup->backupUser($target, $user);
 		} catch (\Throwable $e) {
 			$output->writeln('<error>' . $e->getMessage() . '</error>');

lib/Command/KeyImport.php

@@ -58,7 +58,12 @@ HELP);
 		}
 		$file = $input->getOption('passphrase-file');
 		if ($file !== null) {
-			$pass = rtrim((string)@file_get_contents($file), "\r\n");
+			$raw = @file_get_contents($file);
+			if ($raw === false) {
+				$output->writeln('<error>Cannot read the passphrase file</error>');
+				return 1;
+			}
+			$pass = rtrim($raw, "\r\n");
 		} else {
 			$helper = $this->getHelper('question');
 			$q = (new Question('Passphrase of one of the kit\'s slots: '))->setHidden(true)->setHiddenFallback(false);

lib/Command/RestoreUser.php

@@ -48,9 +48,9 @@ HELP);
 
 	protected function execute(InputInterface $input, OutputInterface $output): int {
 		try {
-			$this->installer->ensureEnabled($input, $output);
 			$output->writeln('<comment>Note: on restore, user_migration only imports the app settings on its own allowlist (e.g. calendar view and reminder settings); other app settings of this user are skipped. Reason: NG Backup uses user_migration\'s importer; widening the list would mean building a settings importer of our own.</comment>');
 			$target = $this->targets->get($input->getArgument('target'));
+			$this->installer->ensureEnabled($input, $output);
 			$user = $this->userRestore->restoreUser($target, (string)$input->getArgument('manifest'), (string)$input->getOption('mode'));
 		} catch (\Throwable $e) {
 			$output->writeln('<error>' . $e->getMessage() . '</error>');

lib/Command/Retention.php

@@ -33,6 +33,10 @@ final class Retention extends Command {
 	}
 
 	protected function execute(InputInterface $input, OutputInterface $output): int {
+		if ($input->getOption('user-last') !== null && !ctype_digit((string)$input->getOption('user-last'))) {
+			$output->writeln('<error>--user-last must be a whole number</error>');
+			return 1;
+		}
 		$p = $this->prune->policy()->toArray();
 		$changed = false;
 		foreach (['last', 'daily', 'weekly', 'monthly'] as $k) {
@@ -50,13 +54,8 @@ final class Retention extends Command {
 			}
 		}
 		if ($input->getOption('user-last') !== null) {
-			$userLast = (string)$input->getOption('user-last');
-			if (!ctype_digit($userLast)) {
-				$output->writeln('<error>--user-last must be a whole number</error>');
-				return 1;
-			}
 			try {
-				$this->prune->setUserExportRetention((int)$userLast);
+				$this->prune->setUserExportRetention((int)$input->getOption('user-last'));
 			} catch (\InvalidArgumentException $e) {
 				$output->writeln('<error>' . $e->getMessage() . '</error>');
 				return 1;