backups: the collection interval was never actually readable

Backup-NtlarsSettings reads backups_intervalhours from /api/settings/public,
because it runs before it holds any credential, and its Get-IntervalHours falls
back to 24 on any failure. The plugin never declared the key public, so the
endpoint did not return it, the fallback fired on every PC, and the setting
looked configurable in the UI while changing nothing. The fleet log shows the
symptom plainly: "Throttled: last attempt under 24h ago", every cycle,
regardless of what the setting said.

Declared public. A collection cadence is not a secret. backups_shareroot stays
private - it is internal topology - and the test asserts both directions so a
later edit cannot quietly widen it.

Same defect as the 3D parts kiosk label prefix already in this changelog: a
logged-out reader against an allowlist its key was not on. Worth noticing that
the pattern has now bitten twice.

tests/test_plugins/test_backups.py

@@ -847,3 +847,18 @@ def test_retention_prunes_each_pc_separately(bk_app, bk_plugin):
         rows = _db.session.query(BackupRevision).all()
         sources = [row.sourcehostname for row in rows]
         assert 'QUIET' in sources, 'the quiet PC lost its only backup'
+
+
+def test_the_collection_interval_is_readable_without_a_login(bk_app):
+    """The collecting script reads backups_intervalhours from
+    /api/settings/public before it holds any credential, and its
+    Get-IntervalHours falls back to 24 on ANY failure - silently. Off the
+    allowlist, the setting looks configurable in the UI and is not: every PC
+    keeps using 24. The share root must NOT be public; it is internal topology.
+    """
+    from plugins.backups.plugin import BackupsPlugin
+
+    declared = {entry['key']: entry for entry in
+                BackupsPlugin().get_settings_defaults()}
+    assert declared['backups_intervalhours'].get('public') is True
+    assert not declared['backups_shareroot'].get('public')