R5 the server's own settings: instance, rules, announcements, relays, media limits, the staff's log

A singleton ServerSettings (title, descriptions, contact, thumbnail, privacy policy, terms, rules, relays, media
overrides, PublishActivity), cached by InstanceSettings and read by the instance API, NodeInfo, the instance actor, the
web pages and the mailer; its defaults are the old literals, so nothing changes until an administrator edits.
/clientapi/admin/settings (and /thumbnail), /announcements, /relays for administrators; /clientapi/moderator/log, the
staff's log (AdminAction, written by domain blocks, backups, settings and the CLI; no IP, never a root paired with its
personas). The Mastodon API's rules, extended description, privacy policy, terms of service, domain blocks (Published,
Obfuscate), announcements (dismiss, reactions, streaming) and activity (only when published). Reports carry rule ids.
Media overrides clamped to hard caps. Relays named by the settings reconcile next to the configured ones.

Verified: interop.sh instance accounts relay with mastodon, relay, aoderelay and mailpit, 119 passed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Infrastructure/Backup/ProtectiveMerge.cs

@@ -13,7 +13,10 @@ namespace PrivaPub.Infrastructure.Backup
 	//   deletion left it), with what a deletion takes away; P's moderation of a persona (silenced, suspended, banned) stays;
 	// - a root keeps P's password, e-mail, ban and policies;
 	// - roots, personas and groups made since become tombstones: deleted, their names kept; local posts made since answer
-	//   410; media made since go to the trash, as do media trashed since (and they leave the posts restored with them);
+	//   410; media made since go to the trash, as do media trashed since (and they leave the posts restored with them),
+	//   but the server's own pictures the live settings hold;
+	// - the staff's log is the union (a restore never loses an entry, its own request included), and the server's
+	//   settings are P's: the live settings outlive a restore;
 	// - every session ends, and every server's circuit is closed again.
 	// Run on the imported database, it reads P's files only, so it can run again after a failed attempt.
 	public static class ProtectiveMerge
@@ -29,7 +32,8 @@ namespace PrivaPub.Infrastructure.Backup
 			("DeletedObject", ["ObjectURI"]),
 			("Report", ["_id"]),
 			("PersonaFilter", ["_id"]),
-			("openiddict.applications", ["client_id"])
+			("openiddict.applications", ["client_id"]),
+			("AdminAction", ["_id"])
 		];
 
 		const string Since = "restore: made after the backup";
@@ -39,8 +43,8 @@ namespace PrivaPub.Infrastructure.Backup
 			IEnumerable<BsonDocument> P(string collection) => ServerRestore.Read(Path.Combine(previous, collection + ".jsonl.gz"));
 			var now = DateTime.UtcNow;
 
-			// who follows whom: P's
-			foreach (var collection in new[] { "Follower", "Following" })
+			// who follows whom: P's; and the server's settings as they were live
+			foreach (var collection in new[] { "Follower", "Following", "ServerSettings" })
 			{
 				await database.DropCollectionAsync(collection, token);
 				await ServerRestore.Insert(database.GetCollection<BsonDocument>(collection), P(collection), token);
@@ -206,7 +210,9 @@ namespace PrivaPub.Infrastructure.Backup
 				{
 					if (!restored.TryGetValue(row["_id"], out var mine))
 					{
-						if (!IsSet(row, "TrashedAt"))
+						// made since, and to the trash, but a picture of the server's own (its thumbnail): the live settings,
+						// which a restore keeps, still show it
+						if (!IsSet(row, "TrashedAt") && !IsSet(row, "ServerUse"))
 						{
 							row["TrashedAt"] = now;
 							row["TrashReason"] = Since;
@@ -223,7 +229,7 @@ namespace PrivaPub.Infrastructure.Backup
 					report.MediaTrashed++;
 				}
 				await ServerRestore.Insert(media, made, token);
-				report.MediaTrashed += made.Count(m => m["TrashReason"] == Since);
+				report.MediaTrashed += made.Count(m => m.GetValue("TrashReason", BsonNull.Value) == Since);
 			}
 
 			var deleted = await (await posts.FindAsync(new BsonDocument("DeletedAt", new BsonDocument("$ne", BsonNull.Value)),