Merge branch 'fix/backup-rotation-and-deletion' into release/v1.39.3

# Conflicts:
#	docs/api/openapi.yaml
#	src/lib/jobs/apple-health-import-worker.ts

scripts/env-manifest.json

@@ -323,6 +323,11 @@
           "purpose": "Trusted reverse-proxy hop count; the client IP is read that many entries from the right of X-Forwarded-For.",
           "example": "1"
         },
+        {
+          "name": "BACKUP_ENCRYPTION_PREVIOUS_KEYS",
+          "purpose": "Comma-separated off-host backup keys that are no longer written with but may still be needed to read older objects. Set during a rotation of BACKUP_ENCRYPTION_KEY until the bucket's lifecycle rule has retired every object written under the old key.",
+          "example": ""
+        },
         {
           "name": "BACKUP_MAX_STORED_MB",
           "purpose": "Largest stored backup of one account the app keeps, in megabytes of encrypted copy (2048 by default). A storage limit, independent of the app's memory: a backup past it fails with a message naming this variable, and the previous copy stays.",

scripts/restore-backup.ts

@@ -32,6 +32,7 @@ import {
   loadOffhostConfig,
   getS3Client,
   openBackupObject,
+  offhostKeyRing,
   OffhostBackupNotConfiguredError,
 } from "@/lib/jobs/offhost-backup";
 
@@ -109,7 +110,7 @@ async function main() {
     `Downloading s3://${cfg.bucket}/${key} from ${cfg.endpoint} (region=${cfg.region})`,
   );
   const ciphertext = await s3.getObject(key);
-  const source = openBackupObject(ciphertext, cfg.encryptionKey);
+  const source = openBackupObject(ciphertext, offhostKeyRing(cfg), key);
 
   // Checked first, in one streamed pass that keeps only the small sections,
   // so nothing is written for an object that is not a backup.