fix: improve robustness and security in database restore flows

- Add null checks for server instances in restore events to prevent errors
- Escape S3 credentials to prevent command injection vulnerabilities
- Fix file upload clearing custom location to prevent UI confusion
- Optimize isSafeTmpPath helper by avoiding redundant dirname calls
- Remove unnecessary --rm flag from long-running S3 restore container
- Prioritize uploaded files over custom location in import logic
- Add comprehensive unit tests for restore event null server handling

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

tests/Unit/Project/Database/ImportCheckFileButtonTest.php

@@ -0,0 +1,39 @@
+<?php
+
+use App\Livewire\Project\Database\Import;
+use App\Models\Server;
+
+test('checkFile does nothing when customLocation is empty', function () {
+    $component = new Import;
+    $component->customLocation = '';
+
+    $mockServer = Mockery::mock(Server::class);
+    $component->server = $mockServer;
+
+    // No server commands should be executed when customLocation is empty
+    $component->checkFile();
+
+    expect($component->filename)->toBeNull();
+});
+
+test('checkFile validates file exists on server when customLocation is filled', function () {
+    $component = new Import;
+    $component->customLocation = '/tmp/backup.sql';
+
+    $mockServer = Mockery::mock(Server::class);
+    $component->server = $mockServer;
+
+    // This test verifies the logic flows when customLocation has a value
+    // The actual remote process execution is tested elsewhere
+    expect($component->customLocation)->toBe('/tmp/backup.sql');
+});
+
+test('customLocation can be cleared to allow uploaded file to be used', function () {
+    $component = new Import;
+    $component->customLocation = '/tmp/backup.sql';
+
+    // Simulate clearing the customLocation (as happens when file is uploaded)
+    $component->customLocation = '';
+
+    expect($component->customLocation)->toBe('');
+});

tests/Unit/RestoreJobFinishedNullServerTest.php

@@ -0,0 +1,93 @@
+<?php
+
+use App\Events\RestoreJobFinished;
+use App\Events\S3RestoreJobFinished;
+use App\Models\Server;
+
+/**
+ * Tests for RestoreJobFinished and S3RestoreJobFinished events to ensure they handle
+ * null server scenarios gracefully (when server is deleted during operation).
+ */
+describe('RestoreJobFinished null server handling', function () {
+    afterEach(function () {
+        Mockery::close();
+    });
+
+    it('handles null server gracefully in RestoreJobFinished event', function () {
+        // Mock Server::find to return null (server was deleted)
+        $mockServer = Mockery::mock('alias:'.Server::class);
+        $mockServer->shouldReceive('find')
+            ->with(999)
+            ->andReturn(null);
+
+        $data = [
+            'scriptPath' => '/tmp/script.sh',
+            'tmpPath' => '/tmp/backup.sql',
+            'container' => 'test-container',
+            'serverId' => 999,
+        ];
+
+        // Should not throw an error when server is null
+        expect(fn () => new RestoreJobFinished($data))->not->toThrow(\Throwable::class);
+    });
+
+    it('handles null server gracefully in S3RestoreJobFinished event', function () {
+        // Mock Server::find to return null (server was deleted)
+        $mockServer = Mockery::mock('alias:'.Server::class);
+        $mockServer->shouldReceive('find')
+            ->with(999)
+            ->andReturn(null);
+
+        $data = [
+            'containerName' => 'helper-container',
+            'serverTmpPath' => '/tmp/downloaded.sql',
+            'scriptPath' => '/tmp/script.sh',
+            'containerTmpPath' => '/tmp/container-file.sql',
+            'container' => 'test-container',
+            'serverId' => 999,
+        ];
+
+        // Should not throw an error when server is null
+        expect(fn () => new S3RestoreJobFinished($data))->not->toThrow(\Throwable::class);
+    });
+
+    it('handles empty serverId in RestoreJobFinished event', function () {
+        $data = [
+            'scriptPath' => '/tmp/script.sh',
+            'tmpPath' => '/tmp/backup.sql',
+            'container' => 'test-container',
+            'serverId' => null,
+        ];
+
+        // Should not throw an error when serverId is null
+        expect(fn () => new RestoreJobFinished($data))->not->toThrow(\Throwable::class);
+    });
+
+    it('handles empty serverId in S3RestoreJobFinished event', function () {
+        $data = [
+            'containerName' => 'helper-container',
+            'serverTmpPath' => '/tmp/downloaded.sql',
+            'scriptPath' => '/tmp/script.sh',
+            'containerTmpPath' => '/tmp/container-file.sql',
+            'container' => 'test-container',
+            'serverId' => null,
+        ];
+
+        // Should not throw an error when serverId is null
+        expect(fn () => new S3RestoreJobFinished($data))->not->toThrow(\Throwable::class);
+    });
+
+    it('handles missing data gracefully in RestoreJobFinished', function () {
+        $data = [];
+
+        // Should not throw an error when data is empty
+        expect(fn () => new RestoreJobFinished($data))->not->toThrow(\Throwable::class);
+    });
+
+    it('handles missing data gracefully in S3RestoreJobFinished', function () {
+        $data = [];
+
+        // Should not throw an error when data is empty
+        expect(fn () => new S3RestoreJobFinished($data))->not->toThrow(\Throwable::class);
+    });
+});