feat(backend): add optional tool-result/telemetry pipeline and harden control-plane + storage governance

[bitifirefly]

This PR delivers the agreed non-hardware scope with backward-compatible defaults.

• Runtime:
  • Add optional tool_result event handling (ACK + lifelog audit + optional device operation status update).
  • Add optional telemetry normalization (opencane.telemetry.v1) and optional telemetry sample persistence.
• Control plane:
  • Support wrapped runtime-config payloads (data/meta).
  • Enforce safer apply rules: reject expired config, prevent non-rollback regressions, allow explicit rollback.
• Storage & retrieval:
  • Add telemetry_samples table and migration (SQLite lifelog schema v7).
  • Add retention cleanup capabilities for runtime events, thought traces, sessions, operations, and telemetry samples.
  • Upgrade Qdrant embedding path with provider-backed optional embedding and automatic fallback.
• API & governance:
  • Add telemetry sample query endpoint and retention cleanup endpoint.
  • Add optional sensitive-field redaction in device binding query responses.
  • Improve control API compatibility for legacy operation fields.
• Ops/docs:
  • Document new config flags, retention behavior, and local backup/restore workflow.
  • Add backup/restore utility (scripts/lifelog_backup_restore.py).