Add database backup/restore feature with admin UI

- Backup service using VACUUM INTO for WAL-safe atomic snapshots
- Server-side storage in DATA_DIR/backups with download/upload API routes
- Restore with integrity validation and automatic pre-restore safety backup
- Scheduled daily backups via cron with configurable retention
- Admin-only settings UI consolidated under single Server section
- Clean up account section sign-out button, fix switch sub-pixel rendering

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/api/backup/[filename]/route.ts

@@ -0,0 +1,45 @@
+import { statSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { headers } from "next/headers";
+import { type NextRequest, NextResponse } from "next/server";
+import { auth } from "@/lib/auth/server";
+import { getBackupPath } from "@/lib/services/backup";
+
+export async function GET(
+  _req: NextRequest,
+  { params }: { params: Promise<{ filename: string }> },
+) {
+  const session = await auth.api.getSession({ headers: await headers() });
+  if (!session) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (session.user.role !== "admin") {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  const { filename } = await params;
+
+  // Sanitize to prevent path traversal
+  const safe = path.basename(filename);
+  if (!safe || safe !== filename || safe.includes("..")) {
+    return NextResponse.json({ error: "Invalid filename" }, { status: 400 });
+  }
+
+  const backupPath = getBackupPath(safe);
+  if (!backupPath) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+
+  const buffer = await readFile(backupPath);
+  const stat = statSync(backupPath);
+
+  return new NextResponse(new Uint8Array(buffer), {
+    status: 200,
+    headers: {
+      "Content-Type": "application/x-sqlite3",
+      "Content-Disposition": `attachment; filename="${safe}"`,
+      "Content-Length": String(stat.size),
+    },
+  });
+}

app/api/backup/restore/route.ts

@@ -0,0 +1,36 @@
+import { headers } from "next/headers";
+import { NextResponse } from "next/server";
+import { auth } from "@/lib/auth/server";
+import { restoreFromBackup } from "@/lib/services/backup";
+
+const MAX_SIZE = 500 * 1024 * 1024; // 500MB
+
+export async function POST(req: Request) {
+  const session = await auth.api.getSession({ headers: await headers() });
+  if (!session) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (session.user.role !== "admin") {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  const formData = await req.formData();
+  const file = formData.get("file") as File | null;
+  if (!file) {
+    return NextResponse.json({ error: "No file provided" }, { status: 400 });
+  }
+
+  if (file.size > MAX_SIZE) {
+    return NextResponse.json({ error: "File too large" }, { status: 413 });
+  }
+
+  const buffer = Buffer.from(await file.arrayBuffer());
+
+  try {
+    restoreFromBackup(buffer);
+    return NextResponse.json({ success: true });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Restore failed";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}