Find rsync in PATH and pass the SSH password only to rsync

A missing /usr/bin/rsync ended in a traceback, possibly after --remove-before-backup had removed old backups, and left SSHPASS in the environment.

tests/test_local.py

@@ -6,6 +6,7 @@ import os
 from collections.abc import Callable, Iterator
 from datetime import datetime, timedelta
 from pathlib import Path
+from shutil import which
 from typing import Any
 
 import pytest
@@ -338,10 +339,21 @@ class TestReturnCodes:
         assert run_backup(out, [str(src)]) == 0
 
         (args,) = fake_popen.calls
-        assert args[0] == '/usr/bin/rsync'
+        assert args[0] == which('rsync')
         assert f'--link-dest={out}/simple_backup/{old_backups[-1]}' in args
         assert args[args.index('/') + 1] == f'{out}/simple_backup/2026-10-14_10-00-00'
 
+    def test_rsync_missing(self, src: Path, out: Path, tmp_path: Path, fake_popen: type[FakePopen],
+                           old_backups: list[str], monkeypatch: pytest.MonkeyPatch,
+                           caplog: pytest.LogCaptureFixture) -> None:
+        monkeypatch.setenv('PATH', str(tmp_path / 'empty'))
+
+        assert run_backup(out, [str(src)], keep=0, remove_before=True) == 4
+        assert fake_popen.calls == []
+        # Nothing was removed
+        assert backups(out) == old_backups
+        assert 'rsync not found' in caplog.text
+
     @pytest.mark.parametrize('returncode, result, removed', [
         (0, 0, True),
         (24, 0, True),