feat(523): backup destinations - a folder or an S3 bucket, with the S3 secret sealed and kept out of backups

services/backup_s3.py is FabledSteward's SigV4 client ported (put + list,
never delete, so an append-only key is enough), with its tests against
AWS's published signatures. services/backup_destination.py holds the
admin config (backup_config JSON) and delivers a dated tar to a mounted
folder or a bucket, and checks either without sending a backup.
services/secrets.py seals the S3 secret with Fernet under a key derived
from SECRET_KEY; backup._SETTINGS_NOT_EXPORTED keeps it out of every
backup. cryptography becomes a direct dependency (already in the image
through pyjwt).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

pyproject.toml

@@ -13,6 +13,10 @@ dependencies = [
     "asyncpg>=0.29",
     "alembic>=1.13",
     "httpx>=0.27",
+    # Seals the backup destination's S3 secret at rest (services/secrets.py).
+    # Already in the image through pyjwt; named here because Scribe now
+    # imports it directly.
+    "cryptography",
     "hypercorn>=0.17",
     "bcrypt>=4.0",
     "aiosmtplib>=3.0",