fix(backup): make EasyDash backup callback flow consistent

[mrrobot47]

Summary

Makes the EasyDash (--dash-auth) backup callback flow consistent, so the command's exit status, the console message, and the callback EasyDash receives all agree with what actually happened.

Bugs fixed

1. False success after rollback. When the upload succeeded but the EasyDash success callback failed, rollback_failed_backup() deleted the just-uploaded backup, yet the command still printed EE::success('Backup created successfully.') and exited 0. It now captures the error, rolls back, and EE::errors — accurate non-zero exit + message.
2. Suppressed failure callback. dash_backup_completed was set true before the success callback, so a failed callback also suppressed the shutdown failure callback → EasyDash was told neither success nor failure. It is now set only after a confirmed success callback (and on the non-dash path), so the failure callback fires.
3. At-most-one terminal callback. New dash_callback_sent guard, set at the real send sites and checked by the shutdown handler — at most one terminal callback (success XOR failure) on every EE::error/exit path. A PHP fatal (E_ERROR) still sends none: EE_Site_Command's shutdown handler exits from rollback() before the dash handler runs (pre-existing, tracked separately).
4. Orphan signal on purge failure. If the rollback rclone purge also fails (the orphan survives on remote), EasyDash now receives the accurate "manually delete <path>" message (code 4003) instead of the optimistic "rolled back" one — capture_error is first-wins, so the purge-failure branch force-overwrites it.

Also: the new callback-failure uses code 4004 (avoids colliding with the existing 4002 "Database backup failed"); the rollback-success notice is demoted EE::success→EE::log (it always precedes a terminal error). The global backup lock is released before the rollback and the failure callback, so an EasyDash outage (callback retries sleep up to 3×300 s) no longer holds every other queued backup on the server behind this one.

Verification

Against a stub EasyDash endpoint: callback 200 → exit 0, one success callback; success callback 400 → the upload is purged, exit 1, one failure callback with 4004; callback 400 plus a failing purge → exit 1, one failure callback with 4003 and the "manually delete <path>" message; upload failure → one 4001; disabled site → one 1003; no --dash-auth → no callbacks, exit 0. The global lock is free while the failure callback is in flight.

Tested on Ubuntu 26.04 with EasyEngine 4.12.0, on a local rclone remote and on a real rclone remote (the callback-400 case purges only the new upload; earlier backups are untouched).

[Copilot]

Pull request overview

This PR aligns EasyDash (--dash-auth) backup outcomes so the CLI exit status and console output match what EasyDash is told via callbacks, especially around callback failures and rollback behavior.

Changes:

• Delays marking dash_backup_completed until after a confirmed EasyDash success callback, ensuring the shutdown failure callback is not accidentally suppressed.
• Introduces dash_callback_sent as a guard so exactly one terminal callback (success or failure) is emitted.
• Improves rollback error reporting so a rollback purge failure reports an accurate “manual delete” message/code to EasyDash and avoids misleading success logging during an overall failure.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.