test: repair four stale backend suites

All four asserted contracts the product has since moved past. No genuine
product bugs behind any of them; assertions were tightened, not loosened.

adminAuth (3 tests): never mounted errorHandler, so ConflictError/
ValidationError arrived as empty Express defaults. The route also checks
username before email, so the "email conflict" fixture was hitting the
username branch. Mount the handler, fix the fixture, match the real response
shapes.

backupService.enhanced (12 tests): three stacked drifts -- the db mock had no
.returning(), so every runBackup threw at the insert; ensureDatabaseDumpForBackup
now lazily requires ./databaseBackup inside the run, which fails under
mock-fs; and the rsync path moved from exec(shell string) to
spawnAsync('rsync', args) with an isHostAllowed SSRF preflight. Also updates
getBackupStatus to its current shape (frontend aliases, nextScheduledRun null
when no schedule is enabled, #871).

adminSettings.logo: POST /logo gained requirePermission('settings.edit');
the hand-rolled db mock returns a bare Promise from select(), so the
permission lookup threw a TypeError into a 500. Mock the permissions
middleware alongside the already-mocked auth.

crmMintPaths (2 tests): macOS-only. The expected prefix was realpath'd while
the services persist under the raw STORAGE_PATH -- identical on Linux CI
(/var vs /private/var only diverges on macOS), which is why it passed there.
The comment justifying the realpath referenced process.cwd() behaviour the
services no longer have.

Refs testplan REPORT.md #22 (Part 1.2.01).

backend/__tests__/integration/crmMintPaths.test.js

@@ -148,10 +148,15 @@ async function seedCustomerSignedContract() {
 beforeAll(async () => {
   ({ db, cleanup, tmpDir } = await bootCrmDb());
   // Business-doc PDFs (quotes/invoices/contracts) persist under
-  // `process.cwd()/storage/business-docs/...` — chdir into the temp dir
-  // so every test artifact lands isolated and gets cleaned up.
+  // `getStoragePath()/business-docs/...`, and safePath also allows a
+  // `process.cwd()/storage/business-docs/...` root — chdir into the temp
+  // dir so every test artifact lands isolated and gets cleaned up.
   process.chdir(tmpDir);
-  storageRoot = path.join(fs.realpathSync(tmpDir), 'storage', 'business-docs');
+  // Mirror what the services store: the raw STORAGE_PATH bootCrmDb
+  // exported, NOT a symlink-resolved variant. On macOS os.tmpdir() is
+  // /var/... while realpath is /private/var/..., so canonicalizing here
+  // would make every stored path fail the prefix check.
+  storageRoot = path.join(process.env.STORAGE_PATH, 'business-docs');
 
   // Fail-fast on the pre-existing logActivity-inside-transaction
   // deadlock: createContract and createStorno call logActivity() from