Backups

Encrypted scheduled backups with checksum verification (SYS-008). Restore is a full-environment break-glass runbook operation — deliberately not a button.