fix(snapshot): address Copilot review findings

- Guard handleList/handleDownload/handleDelete against a nil manager
  (only reachable if Routes were ever registered while disabled),
  matching the existing handleStatus/handleTrigger pattern instead of
  panicking.
- Add Cache-Control: no-store / Pragma: no-cache to the download
  response, since the zip contains users.db (password hashes, TOTP
  secrets).
- triggerNow() now reloads status/list in a finally block so a failed
  trigger (e.g. 409 already-running) doesn't leave the UI stale.

Author: perber

internal/wiki/snapshot/routes.go

@@ -67,8 +67,18 @@ func (r *Routes) handleStatus(c *gin.Context) {
 	})
 }
 
+// respondNotEnabled writes the standard 503 response for handlers that need
+// a non-nil manager/scheduler, which is only nil if snapshots are disabled.
+func (r *Routes) respondNotEnabled(c *gin.Context) {
+	respondWithSnapshotStatusError(c, http.StatusServiceUnavailable, ErrCodeSnapshotNotEnabled, "Snapshot backup is not enabled", "snapshot backup not enabled")
+}
+
 // handleList returns all finished snapshots, newest first.
 func (r *Routes) handleList(c *gin.Context) {
+	if r.manager == nil {
+		r.respondNotEnabled(c)
+		return
+	}
 	entries, err := r.manager.List()
 	if err != nil {
 		respondWithSnapshotError(c, err)
@@ -80,7 +90,7 @@ func (r *Routes) handleList(c *gin.Context) {
 // handleTrigger triggers an immediate snapshot and returns 202 Accepted.
 func (r *Routes) handleTrigger(c *gin.Context) {
 	if r.scheduler == nil {
-		respondWithSnapshotStatusError(c, http.StatusServiceUnavailable, ErrCodeSnapshotNotEnabled, "Snapshot backup is not enabled", "snapshot backup not enabled")
+		r.respondNotEnabled(c)
 		return
 	}
 	if !r.scheduler.TriggerNow() {
@@ -92,6 +102,10 @@ func (r *Routes) handleTrigger(c *gin.Context) {
 
 // handleDownload streams the ZIP file for a given snapshot id as an attachment.
 func (r *Routes) handleDownload(c *gin.Context) {
+	if r.manager == nil {
+		r.respondNotEnabled(c)
+		return
+	}
 	id := c.Param("id")
 	zipPath, err := r.manager.SnapshotZipPath(id)
 	if err != nil {
@@ -118,12 +132,20 @@ func (r *Routes) handleDownload(c *gin.Context) {
 		disposition = "attachment"
 	}
 	c.Header("Content-Disposition", disposition)
+	// The zip contains users.db (password hashes, TOTP secrets) — never let
+	// proxies/browsers cache it.
+	c.Header("Cache-Control", "no-store")
+	c.Header("Pragma", "no-cache")
 	c.Writer.Header().Set("Content-Type", "application/zip")
 	http.ServeContent(c.Writer, c.Request, filename, stat.ModTime(), f)
 }
 
 // handleDelete removes a snapshot's ZIP and sidecar metadata.
 func (r *Routes) handleDelete(c *gin.Context) {
+	if r.manager == nil {
+		r.respondNotEnabled(c)
+		return
+	}
 	id := c.Param("id")
 	if err := r.manager.Delete(id); err != nil {
 		respondWithSnapshotError(c, err)

internal/wiki/snapshot/routes_test.go

@@ -127,6 +127,42 @@ func TestHandleStatus_Enabled(t *testing.T) {
 	}
 }
 
+func TestHandleList_NotEnabledWhenManagerNil(t *testing.T) {
+	router := newTestRouter(&Routes{})
+
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest(http.MethodGet, "/snapshot", nil)
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusServiceUnavailable {
+		t.Errorf("expected 503, got %d", w.Code)
+	}
+}
+
+func TestHandleDownload_NotEnabledWhenManagerNil(t *testing.T) {
+	router := newTestRouter(&Routes{})
+
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest(http.MethodGet, "/snapshot/snapshot-20260101-000000/download", nil)
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusServiceUnavailable {
+		t.Errorf("expected 503, got %d", w.Code)
+	}
+}
+
+func TestHandleDelete_NotEnabledWhenManagerNil(t *testing.T) {
+	router := newTestRouter(&Routes{})
+
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest(http.MethodDelete, "/snapshot/snapshot-20260101-000000", nil)
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusServiceUnavailable {
+		t.Errorf("expected 503, got %d", w.Code)
+	}
+}
+
 func TestHandleTrigger_NotEnabledWhenSchedulerNil(t *testing.T) {
 	router := newTestRouter(&Routes{})
 
@@ -212,6 +248,9 @@ func TestHandleDownload_ReturnsZip(t *testing.T) {
 	if ct := w.Header().Get("Content-Type"); ct != "application/zip" {
 		t.Errorf("expected Content-Type application/zip, got %q", ct)
 	}
+	if cc := w.Header().Get("Cache-Control"); cc != "no-store" {
+		t.Errorf("expected Cache-Control no-store (snapshot contains users.db), got %q", cc)
+	}
 	disposition := w.Header().Get("Content-Disposition")
 	if disposition == "" {
 		t.Error("expected Content-Disposition header to be set")

ui/leafwiki-ui/src/stores/snapshot.ts

@@ -72,9 +72,15 @@ export const useSnapshotStore = create<SnapshotState>((set, get) => ({
   },
 
   triggerNow: async () => {
-    await triggerSnapshot()
-    await get().loadStatus()
-    await get().loadList()
+    try {
+      await triggerSnapshot()
+    } finally {
+      // Reload even on failure (e.g. 409 because a run is already in
+      // progress) so the UI reflects current server state instead of
+      // staying stale behind the error.
+      await get().loadStatus()
+      await get().loadList()
+    }
   },
 
   remove: async (id: string) => {