Write pending block counters before an export

A backup taken within a second of a block missed it. The backup test
also snapshotted while NFQUEUE blocks were still being reported, which
failed the 5.0.0 release run; it now waits until two reads agree.

backend/app.py

@@ -421,6 +421,9 @@ async def reset_firegex(form: ResetRequest):
 @api.get('/export')
 async def export_db():
     """Export all configuration databases as JSON"""
+    # Block counters are written once a second; without this a backup misses the last ones.
+    from routers.services import firewall
+    firewall.flush_blocks()
     dbs = {}
     if not os.path.exists('db'):
         return dbs

tests/integration/test_backup.py

@@ -130,8 +130,15 @@ def test_a_deleted_service_comes_back_whole_and_filtering(api, protected, filter
     _filters_as_configured(channel)
 
     # Read through the services API first, which writes the counters still waiting: what
-    # is compared afterwards includes them.
+    # is compared afterwards includes them. Until two reads agree, because on NFQUEUE a
+    # block reaches the backend after the client has already seen the refusal — one
+    # counted between this snapshot and the export failed the 5.0.0 release run.
     before = _snapshot(api, service_id)
+    for _ in range(10):
+        time.sleep(SETTLE)
+        before, settled = _snapshot(api, service_id), before
+        if before == settled:
+            break
     backup = api.export_backup()
 
     assert api.services_delete(service_id)