fix(sandbox-poc): regenerate api_key when the existing one is garbage; note platform backup gaps

After an iso-prod refresh the instance unique-id changes, so an api_key encrypted
with the OLD id can't be decrypted — Dolibarr renders non-UTF-8 bytes in the field.
The POC's generateApiKey reused any non-empty value, so it copied that garbage into
test/.ai_agent_sandbox.key (corrupt key, 401s). Now it reuses ONLY a clean key
(^[A-Za-z0-9_-]{24,}$); otherwise it clears the field and regenerates. So
`checkpoint provision` after a refresh yields a fresh, working key.

Also documents the open PLATFORM follow-ups in ops/backup/README.md (easy to find
when revisiting ERP backups): the orphaned Longhorn `default` recurring-job group
(other cluster volumes have no offsite backup), and verifying the factory
pg_dumpall host cron.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

test/scripts/admin/userSetup.ts

@@ -228,9 +228,16 @@ async function generateApiKey(
     );
   }
 
-  // If a key is already set, reuse it.
+  // Reuse the existing key ONLY if it is a clean plaintext key. After an iso-prod
+  // refresh the instance unique-id changes, so a key encrypted with the OLD id can
+  // no longer be decrypted — Dolibarr then renders non-UTF-8 bytes in the field.
+  // Reusing that (the old bug) wrote a corrupt key file. Treat anything that isn't
+  // a plausible key (≥24 url-safe chars) as garbage: clear it and regenerate.
   const existing = (await apiKeyInput.first().inputValue()).trim();
-  if (existing.length > 0) return existing;
+  if (/^[A-Za-z0-9_-]{24,}$/.test(existing)) return existing;
+  if (existing.length > 0) {
+    await apiKeyInput.first().fill(""); // drop the undecryptable/garbage value
+  }
 
   // Trigger generation. GUESS: a generate control next to the field. We try a
   // few likely selectors in order and click the first that exists.