fix(backups): сверять сервер и файл подтверждения импорта

shared/api/backups.test.ts

@@ -75,7 +75,7 @@ test("restore, S3 test and sync do not accept empty or malformed success", async
   const original = globalThis.fetch
   try {
     globalThis.fetch = async () => json({}); await assert.rejects(() => restoreBackup(base, "backup-1")); await assert.rejects(() => testBackupStorage(base)); await assert.rejects(() => syncBackupsFromStorage(base))
-    globalThis.fetch = async () => json({ filename: "config.rsc", serverName: "router" }); assert.equal((await restoreBackup(base, "backup-1")).filename, "config.rsc")
+    globalThis.fetch = async () => json({ backupId: "backup-1", serverId: 1, filename: "config.rsc", serverName: "router" }); assert.equal((await restoreBackup(base, "backup-1")).filename, "config.rsc")
     globalThis.fetch = async () => json(storage); assert.equal((await testBackupStorage(base)).secretConfigured, false)
     globalThis.fetch = async () => json({ imported: 0, skipped: 0 }); assert.equal((await syncBackupsFromStorage(base)).imported, 0)
     globalThis.fetch = async () => json({ imported: -1, skipped: 0 }); await assert.rejects(() => syncBackupsFromStorage(base))
@@ -105,3 +105,14 @@ test("download encodes identity and refuses HTML/JSON success bodies", async ()
   globalThis.fetch = async () => new Response("config", { headers: { "Content-Type": "text/plain; charset=utf-8" } }); assert.equal(await (await downloadBackup(base, "backup-1")).text(), "config")
  } finally { globalThis.fetch = original }
 })
+
+ test("restore receipt matches backup and device identity", async () => {
+ const original = globalThis.fetch
+ try {
+  const receipt = { backupId: "backup-1", serverId: 1, filename: "config.rsc", serverName: "renamed router" }
+  for (const patch of [{ backupId: "other" }, { serverId: 2 }, { backupId: undefined }, { serverId: undefined }, { serverId: "1" }]) {
+   globalThis.fetch = async () => json({ ...receipt, ...patch }); await assert.rejects(() => restoreBackup(base, "backup-1", undefined, 1))
+  }
+  globalThis.fetch = async () => json(receipt); assert.equal((await restoreBackup(base, "backup-1", undefined, 1)).serverName, "renamed router")
+ } finally { globalThis.fetch = original }
+})