api-images: off-box backup of uploads/ with a REHEARSED restore - 2.64GB exists in exactly one place, and it is the precondition for the first ?purge=1 caller

The api-images store (2.64GB, ~20.1k jpgs: mars 19898, venus 222, pluto 19, terra 6, plus 179 in _trash and 67 legacy-flat orphans) exists in EXACTLY ONE PLACE - the Hostinger box. No copy anywhere. This is a standing single-copy risk independent of any deploy, and it surfaced only because the frozen-uploads snapshot gate was examined and dropped (blackboard bb-coder-apiimages-cc-muwp3m2j-1ue5yk, 4/4): dropping a control that could not fail does not create this risk, it reveals that the control was never addressing it. WHY THIS IS NOT A DEPLOY GATE: a code deploy cannot touch uploads/ (mirror --reverse with NO --delete, uploads/ hard-excluded, app-code force-push list is app code only). A snapshot taken before an operation that cannot reach the store insures the NEXT operation, so attaching it to a deploy mis-prices it. It belongs on its own cadence, and it is the PRECONDITION FOR THE FIRST ?purge=1 CALLER (see EVO-3) - erasure is the only irreversible path in the service. SAME-DISK IS NOT A SNAPSHOT. Server-side tar into the account is instant and costs ~2.6GB (10.6% -> ~21% of the 25e9 quota, still under the 75 warn line) but shares the disk, the account and the quota it is insuring against - it survives exactly the failures that cannot happen and none of the ones a backup exists for. The artifact must land OFF-BOX. SSH works (port 65002) and PHP 8.4.23 CLI is installed, so tar + scp are both available - the FTP-only belief was a property of the marsapi credential, not of the host. Destination is local disk on whey: never /data-venus (small working files only) and never /gdrive (rclone VFS staleness is the reason /data-venus exists). DONE MEANS A RESTORE WAS READ BACK, not that a tarball exists. An unrehearsed 2.6GB restore is a belief. Restore at least one tenant tree to a scratch path and compare file count and sha256 on a sample against the live box; report the numbers. Then propose a cadence. Refuse in one line if the disk space or the transfer window is not yours to spend.