Thank you! I honestly wasn't even aware of rest-server. However, I just tested it against rest-server and it works.

Set RESTIC_REPOSITORY=rest:http://your-server:8000/your-repo, put your credentials in RESTIC_REST_USERNAME/RESTIC_REST_PASSWORD (or in the URL), and leave out the AWS variables.

So rest-server seems to have an --append-only mode. If that's enabled, backups still succeed, but the retention step is refused, so each run reports an error and old snapshots are never removed.