feat: optional auth + backup/restore reliability fixes

Auth is now optional: when `auth.api_keys` is empty, all endpoints are
open (no login screen, no Bearer tokens). Health endpoint reports
`auth_required` so the frontend knows which mode to use.

Backup/restore fixes:
- Auto-backup uses atomic writes (was `write_text`, risked corruption)
- Startup backup skipped if recent backup exists (<5 min cooldown),
  preventing rapid restarts from rotating out good backups
- Restore rejects all-empty backups to prevent accidental data wipes
- Store saves frozen after restore to prevent stale in-memory data
  from overwriting freshly-restored files before restart completes
- Missing stores during restore logged as warnings
- STORE_MAP completeness verified at startup against StorageConfig

server/CLAUDE.md

@@ -23,7 +23,8 @@ Server uses API key authentication via Bearer token in `Authorization` header.
 
 - Config: `config/default_config.yaml` under `auth.api_keys`
 - Env var: `WLED_AUTH__API_KEYS`
-- Dev key: `development-key-change-in-production`
+- When `api_keys` is empty (default), auth is disabled — all endpoints are open
+- To enable auth, add key entries (e.g. `dev: "your-secret-key"`)
 
 ## Common Tasks