security(backup): add encrypted backup, checksum-before-restore, off-site copy, and restore drill #691

Parent epic: #679

Evidence

Current backup/restore tooling is local and unencrypted; restore does not require checksum verification; credentials may be exposed through connection URIs/process arguments; and target-name, locking, off-site retention, and drill evidence need hardening.

Objective

Make backup confidentiality, integrity, recovery, and operational evidence production-ready.

Scope

• Encrypt backups using secret references/agent-safe mechanisms.
• Produce signed or strongly authenticated checksum manifests.
• Verify checksum and archive structure before any restore mutation.
• Avoid credentials in process arguments and logs.
• Validate target identifiers and prevent accidental production overwrite.
• Add mutual-exclusion locks, retention, off-site copy abstraction, and 3-2-1 guidance.
• Add scheduled restore drill to isolated infrastructure with RTO/RPO report.
• Document optional PITR prerequisites for full production deployments.

Acceptance criteria

• Tampered/incomplete backup is rejected before restore.
• Restore requires explicit target and production overwrite guard.
• Backup and restore logs contain no secrets or sensitive row data.
• Drill verifies schema migrations, tenant isolation, and representative records.
• Key rotation and lost-key procedures are documented.
• Offline/LAN users can use a local encrypted workflow; off-site copy is optional/configured.