fix(auth): address Task 13 deployment review findings

tools/tht/internal/backup/preflight_test.go

@@ -325,6 +325,7 @@ type preflightArchiveSpec struct {
 	entries        []preflightArchiveEntry
 	rawEntries     []preflightRawArchiveEntry
 	rawManifest    []byte
+	volumes        []VolumeMetadata
 }
 
 type preflightArchiveEntry struct {
@@ -337,6 +338,9 @@ type preflightArchiveEntry struct {
 	mode         os.FileMode
 	manifestMode *uint32
 	method       uint16
+	owner        string
+	logicalName  string
+	sourcePath   string
 }
 
 type preflightRawArchiveEntry struct {
@@ -374,6 +378,7 @@ func writePreflightArchive(t *testing.T, archivePath string, spec preflightArchi
 		SchemaVersion: spec.schemaVersion, InstallationID: spec.installationID,
 		CreatedAt: time.Date(2026, 8, 16, 10, 0, 0, 0, time.UTC), SourceRevision: testRevision,
 		IncludesSecrets: spec.includeSecrets, ComposeProject: "thothii-test",
+		Volumes: append([]VolumeMetadata(nil), spec.volumes...),
 	}
 	for _, entry := range spec.entries {
 		checksum := entry.checksum
@@ -384,11 +389,18 @@ func writePreflightArchive(t *testing.T, archivePath string, spec preflightArchi
 		if kind == "" {
 			kind = EntryFile
 		}
-		sourcePath := ""
-		owner := "installation"
+		sourcePath := entry.sourcePath
+		owner := entry.owner
+		if owner == "" {
+			owner = "installation"
+		}
 		if kind == EntryExternalSecret {
-			sourcePath = "/protected/secret"
-			owner = "external-secret"
+			if sourcePath == "" {
+				sourcePath = "/protected/secret"
+			}
+			if entry.owner == "" {
+				owner = "external-secret"
+			}
 		}
 		mode := uint32(entry.mode.Perm())
 		if mode == 0 {
@@ -397,7 +409,7 @@ func writePreflightArchive(t *testing.T, archivePath string, spec preflightArchi
 		if entry.manifestMode != nil {
 			mode = *entry.manifestMode
 		}
-		manifest.Entries = append(manifest.Entries, Entry{Path: entry.path, Kind: kind, Owner: owner, SourcePath: sourcePath, SHA256: checksum, Size: int64(len(entry.body)), Mode: mode, Archived: true, Sensitive: entry.sensitive})
+		manifest.Entries = append(manifest.Entries, Entry{Path: entry.path, Kind: kind, Owner: owner, LogicalName: entry.logicalName, SourcePath: sourcePath, SHA256: checksum, Size: int64(len(entry.body)), Mode: mode, Archived: true, Sensitive: entry.sensitive})
 	}
 	manifestBytes, err := manifest.JSON()
 	if err != nil {