v2: backups management page in settings

[canalesb93]

Summary

Adds a Backups section to the v2 settings modal so admins can manage PostgreSQL dumps from the new dashboard. Previously the only way to manage backups was the v1 admin UI at /settings/backups.

The page wraps the existing internal/service.BackupService via a new admin-only /web/v1/backups/* surface:

Method	Path	What
GET	/web/v1/backups	list backups + status (count, total size, schedule, retention, preflight, db name, backup dir)
POST	/web/v1/backups	create a manual backup
DELETE	/web/v1/backups/{filename}	delete a backup
GET	/web/v1/backups/{filename}/download	stream .sql.gz to the browser
POST	/web/v1/backups/{filename}/restore	restore from an existing file (AlertDialog confirm)
POST	/web/v1/backups/restore	restore from an uploaded .sql.gz (multipart, capped at 500 MB)
PUT	/web/v1/backups/schedule	update schedule + retention

All routes are session-only and admin-only (admin.IsAdmin gate — editor/viewer get 403). The v1 admin handlers at /-/backups/* are unchanged; both UIs coexist.

The SPA side is one new BackupsSection feature component built on existing shadcn primitives (Alert, AlertDialog, Badge, Button, Form, Input, Select, Separator, Skeleton, Tooltip). No new components added to components/ui or components/.

Validation

Tested live against a worktree server with a real PostgreSQL backup created end-to-end (create → list → schedule → confirmations all wired). Desktop and mobile both render cleanly.

Desktop — initial view (1280×1100, dialog clipped to its 600 px max):

Desktop — full content (dialog auto-height so the file list and schedule form are visible):

Mobile (390×844, sheet scrolled to the Backups heading):

Test plan

• GET /web/v1/backups returns status + list with stored files
• POST /web/v1/backups produces a new .sql.gz and the row appears in the list
• DELETE /web/v1/backups/{filename} removes it
• Schedule form persists backup_schedule + backup_retention_days (visible in app_config)
• Restore from upload accepts only .sql.gz; other file types are rejected with INVALID_FILE
• Non-admin sessions hitting any /web/v1/backups/* route receive 403 FORBIDDEN
• Toggling between Account / Backups in the modal preserves the URL-based modal state