WP-30/31/32: backup targets, strategies and execution

SMB (smbclient) and FTP/FTPS (curl with netrc) targets with encrypted
credentials and connection test; strategies with cron schedule, retention,
optional openssl AES-256 encryption; sources: PVC hostpath tar, pg_dumpall
in the Postgres pod, namespace manifests, host directory. Backup job
collects, encrypts, uploads, verifies size, records sha256 and applies
retention on the target; scheduler starts due strategies. Backups page
with target/strategy forms, run now and history. Restore guide in docs.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/api/src/config.rs

@@ -11,6 +11,10 @@ pub struct Config {
     pub fake_host: bool,
     /// Path to a kubeconfig; None infers. Defaults to the microk8s client config if present.
     pub kubeconfig: Option<String>,
+    /// kubectl invocation for backups, e.g. ["/snap/bin/microk8s", "kubectl"].
+    pub kubectl: Vec<String>,
+    /// Scratch directory for backup archives.
+    pub work_dir: std::path::PathBuf,
     pub bind: SocketAddr,
     pub bootstrap_admin: Option<(String, String)>,
     pub cookie_secure: bool,
@@ -34,6 +38,18 @@ impl Config {
             jwt_secret,
             master_key,
             fake_host: env("FAKE_HOST").is_some_and(|v| v == "true" || v == "1"),
+            kubectl: env("KUBECTL")
+                .map(|v| v.split_whitespace().map(String::from).collect())
+                .unwrap_or_else(|| {
+                    if std::path::Path::new("/snap/bin/microk8s").exists() {
+                        vec!["/snap/bin/microk8s".into(), "kubectl".into()]
+                    } else {
+                        vec!["kubectl".into()]
+                    }
+                }),
+            work_dir: env("WORK_DIR")
+                .map(Into::into)
+                .unwrap_or_else(|| "data/work".into()),
             kubeconfig: env("KUBECONFIG").or_else(|| {
                 let microk8s = "/var/snap/microk8s/current/credentials/client.config";
                 std::path::Path::new(microk8s)