Function validate_backend_auth 

pub fn validate_backend_auth(
    auth: &BackendAuth,
    context: &str,
) -> ValidationResult

A cloud-IAM backend’s auth block is well-formed: exactly one of secretRef or workloadIdentity when auth is present (both are Option because the forms share the auth key, so it’s a webhook check — the same shape as validate_source). An absent/empty auth is legal: the well-known keys may ride the encryption-password Secret, and an empty block means exactly that. A workload-identity serviceAccountName must be a valid object name, or the mover Job would be rejected by the API server later with a far less actionable message. context names the backend (e.g. "s3 backend") for the message.