WP-30/31/32: backup targets, strategies and execution

SMB (smbclient) and FTP/FTPS (curl with netrc) targets with encrypted
credentials and connection test; strategies with cron schedule, retention,
optional openssl AES-256 encryption; sources: PVC hostpath tar, pg_dumpall
in the Postgres pod, namespace manifests, host directory. Backup job
collects, encrypts, uploads, verifies size, records sha256 and applies
retention on the target; scheduler starts due strategies. Backups page
with target/strategy forms, run now and history. Restore guide in docs.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/infrastructure/migrations/0005_backups.sql

@@ -0,0 +1,33 @@
+CREATE TABLE backup_targets (
+    id       TEXT PRIMARY KEY,
+    name     TEXT NOT NULL,
+    kind     TEXT NOT NULL CHECK (kind IN ('smb', 'ftp')),
+    host     TEXT NOT NULL,
+    port     INTEGER,
+    share    TEXT NOT NULL DEFAULT '',
+    path     TEXT NOT NULL DEFAULT '',
+    username TEXT NOT NULL DEFAULT '',
+    password TEXT NOT NULL DEFAULT '',
+    tls      INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE backup_strategies (
+    id         TEXT PRIMARY KEY,
+    name       TEXT NOT NULL,
+    source     TEXT NOT NULL,
+    schedule   TEXT NOT NULL,
+    target_id  TEXT NOT NULL REFERENCES backup_targets(id),
+    retention  INTEGER NOT NULL,
+    passphrase TEXT,
+    enabled    INTEGER NOT NULL DEFAULT 1
+);
+
+CREATE TABLE backup_records (
+    id          TEXT PRIMARY KEY,
+    strategy_id TEXT NOT NULL REFERENCES backup_strategies(id) ON DELETE CASCADE,
+    filename    TEXT NOT NULL,
+    size_bytes  INTEGER NOT NULL,
+    sha256      TEXT NOT NULL,
+    created_at  TEXT NOT NULL
+);
+CREATE INDEX backup_records_strategy ON backup_records(strategy_id, created_at DESC);