Verify off-box presence by reading the remote dir back

Exit 0 from the backup script is deliberately tied to ON-BOX durability,
so it is not proof the off-box copy landed. GET /api/internal/backup/offbox
runs rsync --list-only against BACKUP_REMOTE using the SAME pinned
known_hosts as the push (checking never disabled) and returns the dumps
actually present, with size and timestamp — so off-box presence is a
verified fact rather than an inference from an exit code.

Needed because the dev box cannot authenticate to the Storage Box: the
authorized key installed there is Kev's ~/vyndr-backup-key, not the
keypair generated in-session, so independent verification has to run from
the container that does hold working credentials.

Suite 280/3338 green, build exit 0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SmNjJAwEnqHPtXbvSZR8kA

src/routes/internal.js

@@ -329,6 +329,22 @@ router.get('/backup/verify', async (req, res) => {
   }
 });
 
+/**
+ * GET /api/internal/backup/offbox — list the dumps actually present ON the
+ * Storage Box. Exit 0 from the backup is not proof the file landed; this reads
+ * the remote directory back so off-box presence is verified, not inferred.
+ */
+router.get('/backup/offbox', async (req, res) => {
+  const { listOffbox } = require('../backupScheduler');
+  try {
+    const result = await listOffbox();
+    return res.json(result);
+  } catch (err) {
+    const message = err && err.message ? err.message : String(err);
+    return res.status(500).json({ ok: false, error: message });
+  }
+});
+
 /**
  * POST /api/internal/ledger/settle (Session 58, Phase 1) — settle the
  * persistent ledger (outcome + actual_value + CLV) across every sport.