refactor(backend): normalize naming convention to backend rather storage

no ambiguity with the backend rather storage

frontend/src/lib/api/endpoints/admin.ts

@@ -488,7 +488,7 @@ export interface StorageEncryptionPair {
 	cipher: string;
 	/**
 	 * SSH-style colon-hex 8-byte fingerprint of the key. Matches
-	 * `storage_rotate`'s `head_key_fp` and the `oxicloud --fingerprint`
+	 * `backend_rotate`'s `head_key_fp` and the `oxicloud --fingerprint`
 	 * CLI output — enables one-glance identification of which key is
 	 * which. `undefined` for `none:` pairs (no key material).
 	 */
@@ -578,15 +578,15 @@ export function migrationAction(
 }
 
 /**
- * K4 (storage-key-rotation): trigger `storage_rotate` on a specific
+ * K4 (storage-key-rotation): trigger `backend_rotate` on a specific
  * storage entry. Normalises every blob on `<name>` to that entry's
  * head-pair format: legacy → v1, plaintext ↔ encrypted, old-key →
- * new-key. Fire-and-forget — poll `GET /api/admin/jobs/storage_rotate`
+ * new-key. Fire-and-forget — poll `GET /api/admin/jobs/backend_rotate`
  * for status.
  *
  * Backend: `POST /api/admin/storage/entries/{name}/rotate`
- * (`admin_handler::trigger_storage_rotate`). Refuses (400) on unknown
- * entry name or when a `storage_rotate` / `storage_migration` run is
+ * (`admin_handler::trigger_backend_rotate`). Refuses (400) on unknown
+ * entry name or when a `backend_rotate` / `backend_migration` run is
  * already in flight.
  */
 export function rotateStorageEntry(name: string): Promise<void> {

frontend/src/lib/api/types.ts

@@ -556,7 +556,7 @@ export interface JobSummary {
 	 * whether the row is expandable (drawer with run history +
 	 * findings) and to gate the retention/purge action — replaces
 	 * the pre-K3 name-based allowlist that missed newly-added
-	 * recoverable tenants (`storage_rotate` shipped first without a
+	 * recoverable tenants (`backend_rotate` shipped first without a
 	 * row-expand until this flag was added).
 	 */
 	recoverable: boolean;

frontend/src/lib/components/ReadOnlyBanner.svelte

@@ -11,11 +11,11 @@
 	 *
 	 * Rendered inside `AppShell` above `{children}` when the
 	 * `x-server-status` header says the whole server is in read-only
-	 * mode — typically during a `storage_migration` cutover.
+	 * mode — typically during a `backend_migration` cutover.
 	 *
 	 * ## `variant="rotating"` — background key rotation
 	 *
-	 * K4 storage-key-rotation. `storage_rotate` walks blobs in place;
+	 * K4 storage-key-rotation. `backend_rotate` walks blobs in place;
 	 * writes/reads continue normally throughout. Copy makes it clear
 	 * this is a background maintenance banner, not a freeze — the app
 	 * is fully usable.

frontend/src/lib/stores/serverStatus.svelte.ts

@@ -29,9 +29,9 @@ export interface ProgressStatus {
 /**
  * JSON shape emitted in the `x-server-status` header.
  *
- * * `migration` — present only during a `storage_migration` run;
+ * * `migration` — present only during a `backend_migration` run;
  *   engages `readonly = true` (all writes are refused).
- * * `rotation` — present only during a `storage_rotate` run (K4
+ * * `rotation` — present only during a `backend_rotate` run (K4
  *   storage-key-rotation); `readonly` stays false, uploads and
  *   reads continue normally throughout.
  *