[glm-grade=A] fix(backups): remove dead-shadow POST /backups/schedule handler (DC-057)

The router previously registered two POST /backups/schedule handlers:
  - line 60: canonical appId-keyed handler with premiumGating + Joi schema
  - line 520: dead 'name'-keyed handler, no premiumGating, no validation

Express only matches the FIRST registered handler per METHOD+PATH, so the
line-520 handler was unreachable. It was a latent vulnerability waiting on
a future refactor that swapped handler order (e.g. a route-mount change
like the DC-052 audit-log shadowing fix). If ever reached, it would have
- skipped premium gating (licenseManager.requirePremium not called)
- skipped the Joi schema validation (no validateBody)
- written to config.backups[<name>] (different key shape) and silently
  corrupted the backup schedule config

Cleaned up:
  - 32 lines of dead code removed from dashcaddy-api/routes/backups.js
  - 7-line NOTE comment added at the SCHEDULE ENDPOINTS header warning
    future contributors not to re-add the duplicate
  - 7 new tests in __tests__/routes/backups.schedule.routes.test.js
    covering shadowing, legacy schema rejection, canonical success,
    premium gating, GET/DELETE collateral-safety

Verified:
  - jest 7/7 pass
  - full suite 1889/1889 (4 pre-existing pdfkit MODULE_NOT_FOUND unrelated)
  - eslint 0 errors (18 pre-existing warnings, none on touched lines)
  - frontend (status/js/backup-restore.js) only POSTs the canonical schema
  - 90s GLM-5.3 judge round 1: grade=A, 2 polish suggestions folded

[grade=A]

dashcaddy-api/routes/backups.js

@@ -22,6 +22,13 @@ module.exports = function({ backupManager, licenseManager, asyncHandler }) {
   const router = express.Router();
 
   // ==================== SCHEDULE ENDPOINTS (PREMIUM) ====================
+  // NOTE: POST /backups/schedule has a single canonical registration below
+  // (the appId-keyed handler at the top of this section). Earlier versions
+  // registered a duplicate "name"-keyed handler later in the file — Express
+  // only matches the first registered handler per METHOD+PATH, so the
+  // duplicate was unreachable dead code. Do not re-add it; if you need a
+  // different schema, change the canonical Joi schema in
+  // src/utilities/validate.js (backupScheduleCreate) instead.
 
   // Apply premium gating to schedule-related routes
   const premiumGating = licenseManager.requirePremium('auto-backup');
@@ -511,38 +518,6 @@ module.exports = function({ backupManager, licenseManager, asyncHandler }) {
     success(res, storageInfo);
   }, 'backups-storage-info'));
 
-  // Schedule a backup
-  // LEGACY: this is a duplicate registration of POST /backups/schedule (see also line 60,
-  // which uses the appId-keyed schema and is the route the frontend actually calls).
-  // Express only matches the first registered handler per METHOD+PATH, so this handler
-  // is unreachable. It is preserved for now to avoid removing a route any unknown
-  // integration might still POST to. TODO: audit + remove in a dedicated cleanup PR.
-  router.post('/backups/schedule', asyncHandler(async (req, res) => {
-    const { name, schedule, maxStorageBytes, ...backupConfig } = req.body;
-
-    if (!name || !schedule) {
-      return res.status(400).json({ error: 'name and schedule are required' });
-    }
-
-    const config = backupManager.getConfig();
-
-    // Store maxStorageBytes in the backup config (converted to bytes)
-    const maxBytes = typeof maxStorageBytes === 'number' && maxStorageBytes > 0
-      ? maxStorageBytes
-      : (typeof maxStorageBytes === 'string' ? parseStorageSize(maxStorageBytes) : 0);
-
-    config.backups[name] = {
-      ...backupConfig,
-      enabled: true,
-      schedule,
-      maxStorageBytes: maxBytes,
-      destinations: backupConfig.destinations || [{ type: 'local' }]
-    };
-
-    backupManager.updateConfig(config);
-    success(res, { message: `Backup '${name}' scheduled`, maxStorageBytes: maxBytes });
-  }, 'backups-schedule-legacy'));
-
   // Restore from backup
   router.post('/backups/restore/:backupId', validateBody(schemas.backupRestore), asyncHandler(async (req, res) => {
     const result = await backupManager.restoreBackup(req.params.backupId, req.body);