Add manual, optionally-encrypted backup download (no auto-upload)

New POST /backup/download (admin-only) tars the whole jsondb directory
(all servers/clients/users/settings) and streams it back as a file
download. If a passphrase is given, the archive is encrypted first
(AES-256-GCM, scrypt-derived key, backup/encrypt.go) - a small
self-contained format, not gpg/OpenPGP-compatible, to avoid shelling
out to an external binary or adding a PGP dependency.

Deliberately does NOT upload anywhere automatically (e.g. to
Nextcloud) - the archive only ever leaves the server as this one HTTP
response to the requesting admin, who is responsible for storing it
themselves. New "Download Backup" button + passphrase modal on the
Global Settings page.

backup/archive.go

@@ -0,0 +1,61 @@
+// Package backup builds a downloadable, optionally encrypted snapshot of
+// the jsondb directory (servers, clients, users, settings - everything
+// needed to restore this installation). It never transmits data anywhere
+// on its own; the archive is only ever returned to an authenticated admin
+// as an HTTP download, never uploaded automatically.
+package backup
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"os"
+	"path/filepath"
+)
+
+// BuildArchive tars+gzips every regular file under dbPath into memory,
+// preserving paths relative to dbPath so restoring means extracting into a
+// fresh, empty db directory.
+func BuildArchive(dbPath string) ([]byte, error) {
+	var buf bytes.Buffer
+	gzw := gzip.NewWriter(&buf)
+	tw := tar.NewWriter(gzw)
+
+	err := filepath.Walk(dbPath, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if info.IsDir() {
+			return nil
+		}
+		relPath, err := filepath.Rel(dbPath, path)
+		if err != nil {
+			return err
+		}
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		header := &tar.Header{
+			Name:    relPath,
+			Mode:    int64(info.Mode().Perm()),
+			Size:    int64(len(data)),
+			ModTime: info.ModTime(),
+		}
+		if err := tw.WriteHeader(header); err != nil {
+			return err
+		}
+		_, err = tw.Write(data)
+		return err
+	})
+	if err != nil {
+		return nil, err
+	}
+	if err := tw.Close(); err != nil {
+		return nil, err
+	}
+	if err := gzw.Close(); err != nil {
+		return nil, err
+	}
+	return buf.Bytes(), nil
+}

backup/encrypt.go

@@ -0,0 +1,85 @@
+package backup
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"errors"
+	"io"
+
+	"golang.org/x/crypto/scrypt"
+)
+
+const (
+	saltSize = 16
+	keySize  = 32 // AES-256
+)
+
+// deriveKey turns a passphrase into a 32-byte AES key via scrypt, using the
+// given salt. scrypt (N=32768, r=8, p=1) is deliberately expensive to slow
+// down offline brute-force of a leaked archive.
+func deriveKey(passphrase string, salt []byte) ([]byte, error) {
+	return scrypt.Key([]byte(passphrase), salt, 32768, 8, 1, keySize)
+}
+
+// Encrypt symmetrically encrypts data with a passphrase using scrypt key
+// derivation + AES-256-GCM. Output layout: [16-byte salt][12-byte
+// nonce][GCM ciphertext+tag]. This is a small self-contained format
+// specific to this app - NOT OpenPGP/gpg-compatible - chosen to avoid
+// shelling out to an external gpg binary or adding a full PGP dependency.
+func Encrypt(plaintext []byte, passphrase string) ([]byte, error) {
+	salt := make([]byte, saltSize)
+	if _, err := io.ReadFull(rand.Reader, salt); err != nil {
+		return nil, err
+	}
+	key, err := deriveKey(passphrase, salt)
+	if err != nil {
+		return nil, err
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return nil, err
+	}
+	ciphertext := gcm.Seal(nil, nonce, plaintext, nil)
+
+	out := make([]byte, 0, saltSize+len(nonce)+len(ciphertext))
+	out = append(out, salt...)
+	out = append(out, nonce...)
+	out = append(out, ciphertext...)
+	return out, nil
+}
+
+// Decrypt reverses Encrypt, for manual restore/recovery.
+func Decrypt(data []byte, passphrase string) ([]byte, error) {
+	if len(data) < saltSize {
+		return nil, errors.New("backup: ciphertext too short")
+	}
+	salt := data[:saltSize]
+	key, err := deriveKey(passphrase, salt)
+	if err != nil {
+		return nil, err
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+	nonceSize := gcm.NonceSize()
+	if len(data) < saltSize+nonceSize {
+		return nil, errors.New("backup: ciphertext too short")
+	}
+	nonce := data[saltSize : saltSize+nonceSize]
+	ciphertext := data[saltSize+nonceSize:]
+	return gcm.Open(nil, nonce, ciphertext, nil)
+}