A test pins saving and clearing the sealed backup mirror from Settings → Backups, a forge admin's only #7021

POST /settings/backups/mirror and /settings/backups/mirror/clear (backupsMirror and backupsMirrorClear in src/web/pages/backups.ts) have no test.

Done:

• [ ] Each case posts the form the way the page does, through readForm, with the session cookie and a same-origin Origin header. An admin saves a mirror destination, and /settings/backups then shows it. Any credential in it is never shown back. Clearing it says "The sealed mirror is cleared." and the page shows no mirror.
• [ ] A destination saveMirror refuses comes back as a danger flash, and nothing is saved.
• [ ] A non-admin and a cross-origin post are refused, and nothing changes.

Files: test/settings-backups-mirror.test.ts

If the test finds the behaviour wrong, fix the handler it names in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the new test.