Function validate_backend 

pub fn validate_backend(backend: &Backend) -> ValidationResult

Validate backend content the structural schema can’t express: the inline-NFS volume on a Filesystem backend, the secretRef XOR workloadIdentity rule on the cloud-IAM backends, and Azure’s workload-identity prerequisites. Exhaustive match so a new Backend variant must be considered here before it compiles.