An FTP resume spliced a changed remote when there was no cache entry

[xroche]

Stacks on #810 and must not land before it: that PR rewrites the same decision, and this one covers the case it leaves open.

With no cache entry (--cache=0, or an hts-cache someone deleted) nothing separates a genuine partial from a stale complete copy, so back_add() took the resume offset from the file size and FTP sent REST. A remote that had changed since then got its tail appended to the old head, landing at exactly the remote length, so no size check downstream noticed.

FTP has no conditional retrieval, so the decision falls to the client. Refusing every cacheless resume would disable FTP resume altogether, since FTP never writes the .ref marker the HTTP path relies on and the fexist branch is the only resume it has. Comparing bytes across the overlap works on any server but costs an extra data connection every time. So resume only when SIZE reports a remote strictly longer than the local copy and MDTM reports a date equal to the local file's mtime. The mirror is stamped from MDTM, which nothing did for FTP before, so a partial written here compares equal on the next pass and still resumes. The comparison has to be equality rather than "no newer", because every mirror made before this change carries a client-clock mtime ahead of any MDTM, and an ordering test lets all of them through.

Two costs and one hole worth naming. MDTM now goes out for every FTP file, including fresh fetches with no local copy: one extra round trip, and what makes the stamping possible. A server too old to answer it proves nothing and gets a full re-fetch. And a remote that grows while keeping its mtime is still indistinguishable from a partial, so that shape can still splice.

Test 121 asserts on the server's command log rather than the mirror alone. A genuine partial must still come back as REST offset with a byte-identical file, while four shapes must not resume: a longer changed remote, a same-length one, a server that refuses MDTM, and a stale copy dated by the local clock. All four fail on #810's head, on the bytes as well as the log, and the last one also fails on the first draft of this PR.

Closes #823