WP-30/31/32: backup targets, strategies and execution

SMB (smbclient) and FTP/FTPS (curl with netrc) targets with encrypted
credentials and connection test; strategies with cron schedule, retention,
optional openssl AES-256 encryption; sources: PVC hostpath tar, pg_dumpall
in the Postgres pod, namespace manifests, host directory. Backup job
collects, encrypts, uploads, verifies size, records sha256 and applies
retention on the target; scheduler starts due strategies. Backups page
with target/strategy forms, run now and history. Restore guide in docs.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.env.example

@@ -14,3 +14,7 @@ COOKIE_SECURE=false
 # Directory with the built frontend (served as SPA fallback)
 FRONTEND_DIR=../frontend/dist
 RUST_LOG=info,sqlx=warn
+# kubectl invocation used for backups (default: microk8s kubectl if present)
+#KUBECTL=/snap/bin/microk8s kubectl
+# scratch directory for backup archives (default: data/work)
+#WORK_DIR=data/work