fix(usage): stop local backups implying S3 use, and make the protocol-error branch reachable

Two findings from the review of the current head.

Local backups no longer imply S3. markUsed derived an s3_storage marker
from "a backup ran while backup_destination_type is s3" — but the
middleware also counts /database-backup/* and /backup/picpeak/export as
backups, and those write a local file wherever scheduled backups go. So
configuring S3 and downloading a local export reported s3_storage as
USED. The middleware now tells markUsed whether the operation writes to
the configured destination, and only then is the marker derived. A wrong
`true` in this dataset is worse than a missing signal: it is a claim
about an install that nobody can check.

The ProtocolError branch was dead code. adminUsage matched on
`error.name === 'ProtocolError'`, but the class extends Error without
setting `name`, so every instance reports 'Error' — verified — and a
malformed vote or feedback payload fell through to the global handler,
which logs it as an unhandled programming error and answers
INTERNAL_ERROR in production, losing the validation code the caller
needs. Now matched with instanceof. protocol.cjs is byte-identical with
picpeak-usage (diffed against the companion repo), so the fix belongs
here rather than in the class.

An existing assertion needed updating for the new markUsed argument, and
the path split is pinned: /backup/run is destination-driven,
/database-backup/backup and /backup/picpeak/export are not.

Refs #1110

backend/src/middleware/productUsage.js

@@ -28,6 +28,12 @@ const RULES = [
   [/^\/email\/(?:test|send)(?:\/|$)/, ['smtp']],
   [/^\/external-media(?:\/|$)/, ['share_mounts']]
 ];
+// Backup operations that write to the CONFIGURED destination, and so imply
+// S3 use when that destination is S3. Deliberately excludes
+// /backup/picpeak/export and everything under /database-backup/, which
+// produce a local file regardless of where scheduled backups go.
+const DESTINATION_BACKUP = /^\/backup\/(?:run|backup|create|start|test)(?:\/|$)/;
+
 function productUsage(req, res, next) {
   const pathname = req.path;
   res.once('finish', () => {
@@ -42,9 +48,11 @@ function productUsage(req, res, next) {
       features.push('s3_storage');
     if (features.length)
       service
-        .markUsed(features)
+        .markUsed(features, {
+          destinationBackup: DESTINATION_BACKUP.test(pathname)
+        })
         .catch(() => logger.warn('Product usage marker could not be recorded'));
   });
   next();
 }
-module.exports = { productUsage, RULES };
+module.exports = { productUsage, RULES, DESTINATION_BACKUP };

backend/src/routes/adminUsage.js

@@ -4,10 +4,18 @@ const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
 const { ValidationError } = require('../utils/errors');
 const service = require('../services/productUsageService');
+const { ProtocolError } = require('../usage/protocol.cjs');
 const router = express.Router();
 const wrap = (fn) => (req, res, next) =>
   Promise.resolve(fn(req, res)).catch((error) => {
-    if (error.name === 'ProtocolError')
+    // instanceof, not `error.name`: ProtocolError extends Error without
+    // setting `name`, so every instance reports 'Error' and this branch never
+    // ran. A malformed vote or feedback payload fell through to the global
+    // handler, which logs it as an unhandled programming error and answers
+    // INTERNAL_ERROR in production — losing the validation code the caller
+    // needs. protocol.cjs is vendored byte-identical with picpeak-usage, so
+    // the fix belongs here rather than in the class.
+    if (error instanceof ProtocolError)
       return res
         .status(400)
         .json({ error: 'Invalid usage request', code: error.code });

backend/src/usage/UsageService.js

@@ -572,7 +572,7 @@ class UsageService {
     return this.status();
   }
 
-  async markUsed(features) {
+  async markUsed(features, { destinationBackup = false } = {}) {
     const allowed = [...new Set(features)].filter((f) =>
       FEATURE_KEYS.includes(f)
     );
@@ -583,7 +583,12 @@ class UsageService {
       if (this.db.client.config.client === 'pg') query.forUpdate();
       const state = await query.first();
       if (!state || state.status !== 'active') return;
-      if (allowed.includes('backup')) {
+      // Only when the operation actually writes to the configured backup
+      // destination. Deriving this from "a backup ran while S3 is configured"
+      // marked S3 as USED for a local database backup or a .picpeak export,
+      // which the middleware also counts as `backup` — so merely configuring
+      // S3 and downloading a local export claimed S3 was in use.
+      if (destinationBackup && allowed.includes('backup')) {
         const destination = await tx('app_settings')
           .where({ setting_key: 'backup_destination_type' })
           .first();