refactor(backup): keep the upload flow owned by the backups section

The section that renders the recent-proof dialog is the one that hands
the proof to each gated flow, which the recent-proof callers test reads
from its source. The upload hook goes back there and the upload
component takes the flow it returns.

src/components/admin/backups-section.tsx

@@ -30,6 +30,7 @@ import { RestoreJobStatus, visibleRestoreJobs } from "./backup-restore-status";
 import { BackupRowsCards, BackupRowsTable } from "./backups/backup-rows";
 import { DatabaseDumpRow } from "./backups/database-dump-row";
 import { BackupUpload } from "./backups/backup-upload-card";
+import { useBackupUpload } from "./backups/use-backup-upload";
 import {
   RestoreRefusalNotice,
   RestoreSkipReport,
@@ -54,6 +55,7 @@ export function BackupsSection() {
   // a fresh proof unless this session signed in or re-proved within minutes.
   const recentProof = useRecentProof();
   const { downloadingId, handleDownload } = useBackupDownload(recentProof);
+  const uploadFlow = useBackupUpload(recentProof);
   const {
     restoreJobs,
     dismissedRestores,
@@ -123,7 +125,7 @@ export function BackupsSection() {
         <BackupPassActivityNotice activity={data.scheduleActivity} />
       ) : null}
 
-      <BackupUpload recentProof={recentProof} />
+      <BackupUpload flow={uploadFlow} />
 
       {visibleRestoreJobs(restoreJobs, dismissedRestores).map((job) => (
         <RestoreJobStatus

src/components/admin/backups/backup-upload-card.tsx

@@ -1,15 +1,12 @@
 import { Loader2, Upload } from "lucide-react";
 import type { ChangeEvent, RefObject } from "react";
 
-import {
-  ReproofCancelledError,
-  type useRecentProof,
-} from "@/components/settings/security-section/use-recent-proof";
+import { ReproofCancelledError } from "@/components/settings/security-section/use-recent-proof";
 import { Button } from "@/components/ui/button";
 import { useTranslations } from "@/lib/i18n/context";
 
 import { BackupTargetDialog } from "./backup-target-dialog";
-import { useBackupUpload } from "./use-backup-upload";
+import type { useBackupUpload } from "./use-backup-upload";
 
 /**
  * The upload card, and for a file whose account is not on this server, the
@@ -17,9 +14,9 @@ import { useBackupUpload } from "./use-backup-upload";
  * mounted per refused file, so every file starts from a clean form.
  */
 export function BackupUpload({
-  recentProof,
+  flow,
 }: {
-  recentProof: ReturnType<typeof useRecentProof>;
+  flow: ReturnType<typeof useBackupUpload>;
 }) {
   const {
     upload,
@@ -28,7 +25,7 @@ export function BackupUpload({
     orphan,
     uploadInto,
     closeOrphan,
-  } = useBackupUpload(recentProof);
+  } = flow;
   return (
     <>
       <BackupUploadCard