Fix NFS backup destinations broken by the 0.40.0 refactor (0.40.1)

_ensure_helper_image moved to stack_assets_service, but backup_destination_service
imports it lazily inside _nfs_run/_nfs_helper, so nothing failed at import time —
every NFS destination operation raised ImportError at runtime instead. The helper
is now a public ensure_helper_image() and the NFS helpers import it from its new
home. Verified: every services/ and routers/ module imports, and both NFS helper
paths run through to a Docker call instead of ImportError.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/services/backup_destination_service.py

@@ -288,10 +288,10 @@ def _nfs_run(volume: str, command: list[str]) -> str:
 
     from config import settings
     from docker_client import DockerError, get_client
-    from services.backup_service import _ensure_helper_image
+    from services.stack_assets_service import ensure_helper_image
 
     client = get_client()
-    _ensure_helper_image(client)
+    ensure_helper_image(client)
     try:
         out = client.containers.run(
             settings.BACKUP_HELPER_IMAGE,
@@ -314,10 +314,10 @@ def _nfs_helper(volume: str):
 
     from config import settings
     from docker_client import DockerError, get_client, safe_call
-    from services.backup_service import _ensure_helper_image
+    from services.stack_assets_service import ensure_helper_image
 
     client = get_client()
-    _ensure_helper_image(client)
+    ensure_helper_image(client)
     try:
         return safe_call(
             client.containers.create,