Gate storage reconciler schedule behind a disabled-by-default flag

The upload/delete/read paths now self-heal stale storage_used counters and
the upgrade backfill migration repairs existing accounts, so the weekly
reconciler is no longer required. Gate it behind pixelfed.account_storage_
reconcile (ACCOUNT_STORAGE_RECONCILE), defaulting off, so operators can opt
in to the background hygiene job without editing source.

bootstrap/app.php

@@ -166,7 +166,12 @@ return Application::configure(basePath: dirname(__DIR__))
         $schedule->command('app:notification-epoch-update')->weeklyOn(1, '2:21')->onOneServer();
         $schedule->command('app:hashtag-cached-count-update')->hourlyAt(25)->onOneServer();
         $schedule->command('app:account-post-count-stat-update')->everySixHours(25)->onOneServer();
-        $schedule->command('user:storage:recalculate --stale=168')->weeklyOn(3, '3:30')->onOneServer()->withoutOverlapping(1440);
+        if ((bool) config_cache('pixelfed.account_storage_reconcile')) {
+            // Optional drift reconciler. The upload/delete/read paths already
+            // self-heal stale storage_used counters, so this is disabled by
+            // default and only needed to tidy accounts that never upload/delete.
+            $schedule->command('user:storage:recalculate --stale=168')->weeklyOn(3, '3:30')->onOneServer()->withoutOverlapping(1440);
+        }
         $schedule->command('app:instance-update-total-local-posts')->twiceDailyAt(1, 13, 45)->onOneServer();
     })
     ->withExceptions(function (Exceptions $exceptions) {

config/pixelfed.php

@@ -69,6 +69,19 @@ return [
     */
     'max_account_size' => env('MAX_ACCOUNT_SIZE', 1000000),
 
+    /*
+    |--------------------------------------------------------------------------
+    | Account storage reconciler
+    |--------------------------------------------------------------------------
+    |
+    | Optional weekly scheduled task that recalculates users.storage_used from
+    | actual media, correcting drift on accounts that never upload or delete.
+    | The upload/delete/read paths already self-heal stale counters, so this is
+    | a background hygiene job and is disabled by default.
+    |
+    */
+    'account_storage_reconcile' => env('ACCOUNT_STORAGE_RECONCILE', false),
+
     /*
     |--------------------------------------------------------------------------
     | Photo file size limit