feat: add admin backup and restore workflow

[bifrost0x]

Summary

• add a native Backup & Restore section to the existing Administration interface
• create online-consistent backups with SQLite's backup API and coordinated persistent-file snapshots
• provide session-bound one-time downloads plus streamed upload and archive verification
• restore through maintenance mode with double confirmation, password reauthentication, emergency rollback, session invalidation, and a controlled process restart
• introduce backup format v2 with explicit data-schema compatibility while preserving legacy format-v1 restore support

Security and reliability

• require authenticated administrators, CSRF protection, rate limits, and server-side ownership checks for every operation
• keep archives outside DATA_DIR and static paths in restrictive, expiring, per-instance temporary namespaces
• reject traversal, symlinks, duplicate or encrypted members, ZIP bombs, checksum and size mismatches, malformed SQLite databases, non-WebSSH databases, and unsupported schema versions
• serialize web backup, web restore, CLI backup/restore, secret rotation, and persistent writes with shared operation coordination
• preserve restore status across restarts and retain the emergency rollback only when automatic recovery fails

Compatibility

• new CLI and web archives use format v2 / data schema v1
• existing format-v1 archives remain verifiable and restore-compatible
• future data schemas can be inspected but are blocked before restore mutation
• CLI backup create, backup verify, and offline-confirmed backup restore remain supported

Validation

• 1304 passed, 29 skipped, 1 deselected in the complete Python suite; the deselected Node-dependent Playwright-port assertion passed separately with Node
• 70 passed in the available JavaScript unit suite
• JavaScript syntax checks and git diff --check passed
• Docker image build and /ready smoke test passed
• manually verified create, download, upload, verification, destructive restore, automatic Docker restart, and post-restore login

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c3cfbc64de

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Return before running readiness probes during restore

When an orchestrator polls /ready while maintenance is active, this only records a failure and still runs both probes. _probe_data_directory() creates a transient top-level file inside DATA_DIR, so it can race with restore_backup() enumerating and copying persistent files; if the probe deletes that file after enumeration, the restore can fail, and the same race can affect the emergency rollback. The database probe can also reopen the engine after restore_service explicitly disposes it. Return the maintenance 503 before executing either probe.

Useful? React with 👍 / 👎.