feat(backup): secure backup & encrypted export system

[lalalic]

Secure Backup & Encrypted Export

Implements issue #126 — full-featured data backup system with AES-256 encryption.

Features

• Full & selective backup — export all data or choose specific sections
• AES-256 encryption — encrypt with generated key or user passphrase
• JSON & CSV formats — structured JSON or flat CSV export
• SHA-256 integrity verification — tamper detection via content hashing
• HMAC protection — encrypted payloads include HMAC for integrity
• Restore preview — preview restorable data without modifying anything
• Backup history — track all backups with status, size, expiration
• Auto-expiration — 30-day TTL on backup records

Implementation

Component	Details
Migration	030_secure_backup.sql — backup_records table
Model	BackupRecord with type, format, hash, size, status, timestamps
Service	backup.py — encryption, data collection, CSV export, verify, preview, history
Routes	5 endpoints: create, verify, restore/preview, history, delete
Tests	53 passing tests covering encryption, data collection, routes
Docs	docs/secure-backup.md

API Endpoints

Method	Endpoint	Description
POST	/backup/create	Create encrypted/unencrypted backup
POST	/backup/verify	Verify backup integrity
POST	/backup/restore/preview	Preview restorable data
GET	/backup/history	Get backup history
DELETE	/backup/:id	Delete backup record

Stats

• 1,326 lines added across 9 files
• 53 tests — all passing
• Zero external dependencies added

Closes #126