feat(backup): export private database and saved-config bundles

[n30nex]

What this PR does

Adds the first export building block for #72: beacon-backup and a reusable package create a private .tar.gz containing a consistent PostgreSQL SQL dump, the supplied saved YAML verbatim, and a versioned checksum manifest. The finished archive is published without overwriting an existing file. Failures clean up private staging and never publish a partial backup.

The exporter uses an installed pg_dump and libpq PG* connection settings, with no password/DSN in command arguments and no raw client diagnostics in output. It has cancellation, a finite timeout, a five-second lock wait, a configurable SQL-size limit and a 1 MiB saved-config limit. The bundle explicitly excludes deployment environment/secrets outside YAML, referenced external files, runtime-only changes and PostgreSQL cluster roles/ownership/ACL/tablespace placement.

This is independent of the pending admin PRs. This is partial work for #72: server-maintained login, browser download, additional deployment/config packaging and import/overwrite remain separate phases. No live API or database migration changes are included.

Type of change

• New feature
• Tests
• Docs / config

Validation

• go build ./..., gofmt -l ., go vet ./... and go test ./... pass on the Pi's native ARM64 build; local checks pass too.
• Windows race checks pass for the export package.
• Unit/process checks cover archive members/hashes, exact size boundary, private permissions, failures, timeout, cancellation and existing/concurrently-created destination protection.
• The exact ARM64 command passed PostgreSQL 16.15 export and restore into disposable databases: all Beacon migrations, columns, Unicode/bytea/JSON fixtures, relationships, views/materialized data and identity sequence values reconcile. Real client failures, a tiny size limit and a locked-table timeout publish no output.
• CI now repeats that compiled-command round trip using a dedicated PostgreSQL 16 service/client.
• Temporary test databases, containers and network were removed. All 21 unrelated running containers retained their identities, images, PIDs and restart counts; the live preview database and MQTT feeds were not used by the export test.
• Contribution rules read. No new Go dependencies, schema changes or REST API changes; sqlc/Swagger regeneration is not applicable.

Final head: f6921a405d2bdbe4f82df65093f323b360237476. CI run 34770543587 includes the passing PostgreSQL round trip; CodeQL run 34770543602 passes and the bot resolved both file-close review findings after the checked-close correction. Final Pi binary SHA-256: 65fd3b881dbddb07baad200edfeb86ca247af12ded0e219d4b800a487300a932.

AI-assisted implementation and validation under the author's standing approval. Database/config contents and connection credentials are not included in this PR or its evidence.

[n30nex]

@MrAlders0n please review this change with your Claude agent as part of the September 13 Beacon review batch. The current candidate is f6921a405d2b; validation and Pi evidence are in the PR description.

Please check the private export format, finite limits, cleanup, checked file closure, non-overwriting publication and PostgreSQL restore gate. This is partial work for issue #72: browser login/download, complete deployment packaging and import are still outstanding. Its accidental closing link has been removed.