Add manual, optionally-encrypted backup download (no auto-upload)

New POST /backup/download (admin-only) tars the whole jsondb directory
(all servers/clients/users/settings) and streams it back as a file
download. If a passphrase is given, the archive is encrypted first
(AES-256-GCM, scrypt-derived key, backup/encrypt.go) - a small
self-contained format, not gpg/OpenPGP-compatible, to avoid shelling
out to an external binary or adding a PGP dependency.

Deliberately does NOT upload anywhere automatically (e.g. to
Nextcloud) - the archive only ever leaves the server as this one HTTP
response to the requesting admin, who is responsible for storing it
themselves. New "Download Backup" button + passphrase modal on the
Global Settings page.

backup/encrypt.go

@@ -0,0 +1,85 @@
+package backup
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"errors"
+	"io"
+
+	"golang.org/x/crypto/scrypt"
+)
+
+const (
+	saltSize = 16
+	keySize  = 32 // AES-256
+)
+
+// deriveKey turns a passphrase into a 32-byte AES key via scrypt, using the
+// given salt. scrypt (N=32768, r=8, p=1) is deliberately expensive to slow
+// down offline brute-force of a leaked archive.
+func deriveKey(passphrase string, salt []byte) ([]byte, error) {
+	return scrypt.Key([]byte(passphrase), salt, 32768, 8, 1, keySize)
+}
+
+// Encrypt symmetrically encrypts data with a passphrase using scrypt key
+// derivation + AES-256-GCM. Output layout: [16-byte salt][12-byte
+// nonce][GCM ciphertext+tag]. This is a small self-contained format
+// specific to this app - NOT OpenPGP/gpg-compatible - chosen to avoid
+// shelling out to an external gpg binary or adding a full PGP dependency.
+func Encrypt(plaintext []byte, passphrase string) ([]byte, error) {
+	salt := make([]byte, saltSize)
+	if _, err := io.ReadFull(rand.Reader, salt); err != nil {
+		return nil, err
+	}
+	key, err := deriveKey(passphrase, salt)
+	if err != nil {
+		return nil, err
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return nil, err
+	}
+	ciphertext := gcm.Seal(nil, nonce, plaintext, nil)
+
+	out := make([]byte, 0, saltSize+len(nonce)+len(ciphertext))
+	out = append(out, salt...)
+	out = append(out, nonce...)
+	out = append(out, ciphertext...)
+	return out, nil
+}
+
+// Decrypt reverses Encrypt, for manual restore/recovery.
+func Decrypt(data []byte, passphrase string) ([]byte, error) {
+	if len(data) < saltSize {
+		return nil, errors.New("backup: ciphertext too short")
+	}
+	salt := data[:saltSize]
+	key, err := deriveKey(passphrase, salt)
+	if err != nil {
+		return nil, err
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+	nonceSize := gcm.NonceSize()
+	if len(data) < saltSize+nonceSize {
+		return nil, errors.New("backup: ciphertext too short")
+	}
+	nonce := data[saltSize : saltSize+nonceSize]
+	ciphertext := data[saltSize+nonceSize:]
+	return gcm.Open(nil, nonce, ciphertext, nil)
+}