feat(backup): tar.gz format with uploads + manifest, restore guard

- New tar.gz backup format bundling SQLite snapshot + uploads tree + manifest.json (version, app+schema versions, checksums, dbSize)
- BACKUPS_DIR env override; defaults to /app/data/backups in prod, <cwd>/data/backups in dev (matches uploads convention)
- 503 guard in hooks.server.ts while restore is mid-flight (DB file is being swapped); excludes static assets + /api/health; sets Retry-After: 15
- Legacy .db restore still supported (DB-only)
- Restore endpoint adds schema-mismatch detection + force flag; download/schedule endpoints updated
- 256 MiB free-disk safety margin before backup
- tar dep added to package.json; 18 new backupService tests
- i18n labels (en + ru) for new restore/format states

.env.example

@@ -50,6 +50,11 @@ ALLOW_PRIVATE_NETWORK_FETCH="false"
 # scaling horizontally so only one node runs schedulers.
 RUN_SCHEDULERS="true"
 
+# Directory where backup archives are written. Defaults to /app/data/backups
+# in production and <repo>/data/backups in development. Override if you want
+# backups on a separate mount.
+BACKUPS_DIR=""
+
 # Optional bearer token for /api/metrics. When set, scrapers must send
 # `Authorization: Bearer <token>`. When unset, the endpoint is open (typical
 # when the scraper lives on the same private network).