WP-30/31/32: backup targets, strategies and execution

SMB (smbclient) and FTP/FTPS (curl with netrc) targets with encrypted
credentials and connection test; strategies with cron schedule, retention,
optional openssl AES-256 encryption; sources: PVC hostpath tar, pg_dumpall
in the Postgres pod, namespace manifests, host directory. Backup job
collects, encrypts, uploads, verifies size, records sha256 and applies
retention on the target; scheduler starts due strategies. Backups page
with target/strategy forms, run now and history. Restore guide in docs.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/application/src/upgrade_service.rs

@@ -46,7 +46,11 @@ pub struct PackageUpgradeJob {
 }
 
 /// Bridges the synchronous `LineSink` of the updater to the async job log.
-struct ChannelSink(tokio::sync::mpsc::UnboundedSender<String>);
+pub struct ChannelSink(tokio::sync::mpsc::UnboundedSender<String>);
+
+pub fn channel_sink(tx: tokio::sync::mpsc::UnboundedSender<String>) -> ChannelSink {
+    ChannelSink(tx)
+}
 
 impl LineSink for ChannelSink {
     fn line(&self, text: &str) {