Spell out which Coolify backup vars belong on AIGen vs xAIGen.

A URL in BACKUP_INGEST_TOKEN was treated as a missing token. Errors now say to put the URL on AIGen and the same secret on both apps.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/api/library/backup-ingest.post.ts

@@ -1,3 +1,4 @@
+import { backupIngestSecret } from '~/server/utils/backupStudio'
 import { passwordAuthEnabled, privateInstanceId } from '~/server/utils/localAuth'
 import { saveStill } from '~/server/utils/library'
 
@@ -7,9 +8,12 @@ function ingestOwner() {
 }
 
 function assertIngestToken(event: Parameters<typeof getHeader>[0]) {
-  const expected = String(useRuntimeConfig().backupIngestToken || process.env.BACKUP_INGEST_TOKEN || '').trim()
-  if (!expected) {
-    throw createError({ statusCode: 503, statusMessage: 'Backup ingest is not configured' })
+  const expected = backupIngestSecret()
+  if (!expected || /^https?:\/\//i.test(expected)) {
+    throw createError({
+      statusCode: 503,
+      statusMessage: 'Set BACKUP_INGEST_TOKEN on xAIGen to the same secret as BACKUP_STUDIO_TOKEN on AIGen, not a URL.'
+    })
   }
   const header = String(getHeader(event, 'authorization') || '')
   if (header !== `Bearer ${expected}`) {