fix: remove Rancher backup workflow

.gitea/workflows/destroy.yml

@@ -7,14 +7,6 @@ on:
         description: 'Type "destroy" to confirm'
         required: true
         default: ''
-      require_rancher_backup:
-        description: 'Require an existing Rancher B2 backup before destroy'
-        required: true
-        default: 'true'
-        type: choice
-        options:
-          - 'true'
-          - 'false'
 
 concurrency:
   group: prod-cluster
@@ -31,8 +23,6 @@ env:
   TF_VAR_proxmox_api_token_id: ${{ secrets.PROXMOX_API_TOKEN_ID }}
   TF_VAR_proxmox_api_token_secret: ${{ secrets.PROXMOX_API_TOKEN_SECRET }}
   TF_VAR_proxmox_insecure: "true"
-  B2_ACCOUNT_ID: ${{ secrets.B2_ACCOUNT_ID }}
-  B2_APPLICATION_KEY: ${{ secrets.B2_APPLICATION_KEY }}
 
 jobs:
   destroy:
@@ -68,48 +58,6 @@ jobs:
             -backend-config="secret_key=${{ secrets.S3_SECRET_KEY }}" \
             -backend-config="skip_requesting_account_id=true"
 
-      - name: Verify Rancher backup exists
-        if: github.event.inputs.require_rancher_backup == 'true'
-        run: |
-          set -euo pipefail
-          if [ -z "${B2_ACCOUNT_ID}" ] || [ -z "${B2_APPLICATION_KEY}" ]; then
-            echo "B2 credentials are not available in this workflow/environment; cannot verify Rancher backups." >&2
-            exit 1
-          fi
-
-          CREDS=$(printf '%s:%s' "${B2_ACCOUNT_ID}" "${B2_APPLICATION_KEY}" | base64 -w0)
-          AUTH_RESP=$(curl -fsS -H "Authorization: Basic ${CREDS}" https://api.backblazeb2.com/b2api/v2/b2_authorize_account) || {
-            echo "Failed to authorize with B2; check B2_ACCOUNT_ID/B2_APPLICATION_KEY in the destroy environment." >&2
-            exit 1
-          }
-          API_URL=$(printf '%s' "${AUTH_RESP}" | python3 -c "import json,sys; print(json.load(sys.stdin)['apiUrl'])")
-          AUTH_TOKEN=$(printf '%s' "${AUTH_RESP}" | python3 -c "import json,sys; print(json.load(sys.stdin)['authorizationToken'])")
-          BUCKET_ID=$(printf '%s' "${AUTH_RESP}" | python3 -c "import json,sys; print(json.load(sys.stdin).get('allowed', {}).get('bucketId') or '')")
-
-          if [ -z "${BUCKET_ID}" ]; then
-            BUCKET_ID=$(curl -fsS -H "Authorization: Bearer ${AUTH_TOKEN}" \
-              "${API_URL}/b2api/v2/b2_list_buckets?accountId=${B2_ACCOUNT_ID}&bucketName=HetznerTerra" \
-              | python3 -c "import json,sys; buckets=json.load(sys.stdin).get('buckets',[]); print(buckets[0]['bucketId'] if buckets else '')")
-          fi
-
-          LATEST=$(curl -fsS -H "Authorization: Bearer ${AUTH_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "{\"bucketId\":\"${BUCKET_ID}\",\"prefix\":\"rancher-backups/\",\"maxFileCount\":100}" \
-            "${API_URL}/b2api/v2/b2_list_file_names" \
-            | python3 -c "import json,sys; files=json.load(sys.stdin).get('files', []); tars=sorted(f['fileName'] for f in files if f['fileName'].endswith('.tar.gz')); print(tars[-1] if tars else '')")
-
-          if [ -z "${LATEST}" ]; then
-            echo "No Rancher backup found in B2; refusing to destroy cluster." >&2
-            exit 1
-          fi
-
-          echo "Verified Rancher backup exists: ${LATEST}"
-
-      - name: Skip Rancher backup verification
-        if: github.event.inputs.require_rancher_backup == 'false'
-        run: |
-          echo "Rancher backup verification explicitly skipped for this destroy run."
-
       - name: Terraform Destroy
         id: destroy
         working-directory: terraform