[Epic] Backup Support (Roadmap #1)

[AgreeDK]

Summary

Add built-in backup and restore for OpenSAK databases — manual, on-demand backups
plus optional automatic backups — as described in Roadmap item 1.

Backup is at the top of the roadmap because it protects every user's data today,
and because it is the safety net for the automation coming next: once macros and
scheduled imports can change many caches unattended, an easy way back matters.

This is a tracking issue. Each part below gets its own issue when it is picked up
(the issue is created right before the code, not all up front).

What already exists

DatabaseManager (src/opensak/db/manager.py) already provides copy_database,
delete_database, rename and move_databases_to, so "copy" and "delete" from
the roadmap text are largely in place. What's new is backup, restore and
automation.

Until this lands, Help → OpenSAK File Locations… (1.20.0) shows which folders
to back up manually.

Guiding principles

• Consistent snapshots. Databases run in WAL mode, so a plain file copy of an
  open database is not a safe backup. All backups use SQLite's own backup API
  (sqlite3.Connection.backup() or VACUUM INTO).
• Never destroy data implicitly. Restoring over an existing database always
  takes a safety backup of it first. Deleting old backups (retention) is off by
  default and always the user's explicit choice.
• Restore as a new database is the default. Overwriting the active database is
  an explicit, confirmed option.
• Backups are self-describing. Each backup carries a small manifest (OpenSAK
  version, schema version from PRAGMA user_version, database name, cache count,
  timestamp), so restore can validate it before touching anything.
• Large databases must not freeze the UI. Backups run in a worker thread with
  progress, copying in steps. Real-world GSAK databases reach ~29 GB.

Phases

Phase A — Manual backup & restore (first beta)

• WAL-safe snapshot core + fix copy_database to use it — #NNN
• Backup format: zip with the .db snapshot and manifest.json
  (decide whether settings/filter profiles are included)
• Restore: validate file and schema version; "restore as new database"
  (default) and "overwrite active database" (with automatic safety backup,
  engine dispose/reopen, -wal/-shm cleanup)
• "Backups…" dialog under the Database menu: list backups, Back up now,
  Restore, Delete, Open folder, choose backup folder
• Full backup and restore (all databases + settings + filter profiles),
  including path rewriting for restore on a different machine/OS
• Welcome Wizard: "Restore from backup" as an alternative to creating a
  new database

Phase B — Automatic backups

• Optional automatic backup on exit and/or on startup if the latest backup is
  older than N days (runs while OpenSAK is open; no OS scheduler in v1)
• Optional retention: keep the N most recent backups per database
  (off by default)
• Free-disk-space check before backing up; warning or skip option above a
  size threshold

Phase C — Safety snapshots for automation

• Small API for "take a snapshot before a bulk operation", callable from
  imports and later from macros (Roadmap Import PQ Zip file / MacOS Ventura #2)
• Welcome Wizard: backup-location step (Roadmap Add Continuous Integration workflow with automated tests for OpenSAK #4)

Open questions

1. Backup contents — decided: two backup types.
   • Database backup: a WAL-safe snapshot of one database. Fast; used for
     automatic backups and pre-operation safety snapshots.
   • Full backup: everything needed to move OpenSAK to a new machine and
     restore it there — all databases (including ones stored in external
     locations), opensak.json, saved filter profiles, and later the macro
     folder. Taken manually.
   • Deliberately excluded: the IMAP password in the OS keyring (never
     written to a backup; the user re-enters it once), and machine-specific
     state (bootstrap.json, AppImage integration, Qt window geometry).
     Boundary packs are not included (re-downloadable); the manifest records
     which ones were installed so restore can offer to download them.
   • Restore on a new machine places databases in that machine's database
     folder and rewrites the absolute paths in opensak.json (same pattern as
     _rewrite_stale_install_dir_paths() from macOS: fix data-path bug in settings_store.py (writes to wrong directory) #825). Must work across
     platforms (e.g. Windows → Linux).
2. Default location: a subfolder of the data folder is convenient but doesn't
   protect against disk failure. The dialog should say so and encourage choosing
   another drive.
3. Newer backup in an older app (backup schema version > app schema version):
   refuse outright, or allow "restore as new database" with a warning?
4. Size threshold for automatic backups: warn, skip, or ask?

Out of scope for v1

• Cloud / remote backup targets
• OS-level scheduling (cron, Task Scheduler, launchd) while OpenSAK is closed
• Incremental / differential backups

[AgreeDK]

The design for this epic is agreed and lives in the repo, so it can be updated alongside the code:
docs/architecture/backup.md

In short:

• Backup folder chosen by the user (Welcome Wizard and Settings), default Documents/OpenSAK Backups.
• Full backups of all databases plus settings, as one plain folder per backup with a manifest.
• On exit, OpenSAK asks whether to back up (Ask / Always / Never), and doesn't ask when nothing has changed. The last 5 automatic backups are kept; manual backups are never deleted.
• Restore always adds a new database and never overwrites one. Thanks to Move per-database settings (home location, column view) into the database file #659, a restored database opens exactly as it was, with its home location, columns and sort order.

Builds on #943, #549 and #659, which landed in 1.21.0-beta.2. The work is split into seven sub-issues (listed in the design doc), which will be opened one at a time as they're picked up.