feat(databases): S3-compatible backup targets — offsite archives + remote restore

Phase D3. Managed databases can ship backup archives to a configured
S3-compatible destination (AWS S3, MinIO, Garage, …) while the local
copy remains intact.

- backup_targets table: owner-scoped endpoint/bucket/region/prefix +
  encrypted access/secret keys (enc:v1:, never returned, has_credentials)
- create/update probe bucket access before storing; empty keys on update
  keep stored credentials; delete refused (409) while referenced
- databases.backup_target_id assigns a target; external DBs rejected
- backup pipeline uploads via a holder container over docker cp streams;
  remote failure keeps the local archive (logged), row gets remote:true
- restore prefers the local archive; on a missing local copy it downloads
  the remote object into the backup volume first
- holder containers must be started before archive ops — docker cp does
  not resolve volume mounts on never-started (Created) containers, and
  removing the source mid-stream stalls the reader without EOF
- CLI: backup-targets list|add|update|remove|test + databases update
  --backup-target; MCP: 5 new tools; Settings UI card + per-database
  target picker + offsite badge on backups; OpenAPI + llms.txt + CLI.md

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/internal/cli/commands/databases.go

@@ -112,8 +112,12 @@ var dbUpdateCmd = &cobra.Command{
 			v, _ := cmd.Flags().GetString("backup-schedule")
 			body["backup_schedule"] = v
 		}
+		if cmd.Flags().Changed("backup-target") {
+			v, _ := cmd.Flags().GetString("backup-target")
+			body["backup_target_id"] = v
+		}
 		if len(body) == 0 {
-			return &APIError{Message: "nothing to update — pass --public/--private-style flags, --name, or --backup-schedule", ExitCode: ExitError}
+			return &APIError{Message: "nothing to update — pass --public/--private-style flags, --name, --backup-schedule, or --backup-target", ExitCode: ExitError}
 		}
 		data, err := c.Do("PUT", "/databases/"+args[0], body)
 		if err != nil {
@@ -318,6 +322,7 @@ func init() {
 	dbUpdateCmd.Flags().Bool("public", false, "bind the database port on all interfaces")
 	dbUpdateCmd.Flags().String("name", "", "rename the database")
 	dbUpdateCmd.Flags().String("backup-schedule", "", "cron expression for automatic backups (empty clears)")
+	dbUpdateCmd.Flags().String("backup-target", "", "backup target id for offsite archives (empty clears)")
 	for _, cmd := range []*cobra.Command{dbRegisterCmd, dbTestConnCmd} {
 		cmd.Flags().String("type", "postgres", "postgres|mysql|mariadb|mongodb|redis|dragonfly|clickhouse")
 		cmd.Flags().String("host", "", "database host")