feat: Minstrel backs itself up nightly to a folder or an S3 bucket, off until an admin switches it on (#6773)

Admin › Backups shows a verdict first (off, not set up, waiting, backed up,
overdue, failing since when), Back up now, Test destination and the latest
runs, with the settings beside them.

- backup.Service: one run at a time, bounded at 30 minutes; the schedule
  ticks every 5 minutes, catches up a slot missed while the server was down,
  and retries a failure after an hour and then after as long as it has been
  failing. Runs are recorded in backup_runs, pruned after 90 days; a run cut
  off by a shutdown is marked failed at the next start.
- A folder destination writes database/minstrel-<UTC stamp>.tar and refuses
  a folder that isn't there. An S3 destination stages the file, hashes it,
  and uploads it under database/ through a throttled reader (4 MiB/s by
  default, 0 for no limit).
- Test destination checks the form as typed and only lists.
- The bucket secret is sealed like every stored credential; backup_settings
  and backup_runs are left out of the backup itself.
- The panel polls only while a run is going, capped at the run limit plus
  five minutes.

The music switch named in the task is left to #6774, so no control ships
that does nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/secret/stored.go

@@ -35,6 +35,7 @@ var (
 	SubsonicPassword    = Column{"users", "subsonic_password", "id", false}
 	CoverArtAPIKey      = Column{"cover_art_provider_settings", "api_key", "provider_id", false}
 	TagProviderAPIKey   = Column{"tag_provider_settings", "api_key", "provider_id", false}
+	BackupSecretKey     = Column{"backup_settings", "secret_key", "id", true}
 )
 
 // Columns is every sealed column, for SealStored and for anything that has to
@@ -42,6 +43,7 @@ var (
 var Columns = []Column{
 	AcquisitionAPIKey, AcquisitionPassword, AcoustIDAPIKey, SMTPPassword,
 	ListenBrainzToken, SubsonicPassword, CoverArtAPIKey, TagProviderAPIKey,
+	BackupSecretKey,
 }
 
 // Owner is the owner string for a row whose key is key. A single-row table's

internal/secret/stored_test.go

@@ -84,6 +84,7 @@ func TestSealStoredSealsWhatIsInTheClear_Integration(t *testing.T) {
 		`INSERT INTO tag_provider_settings (provider_id, enabled, display_order, api_key)
 		 VALUES ('seal-test', false, 99, 'tag-key')
 		 ON CONFLICT (provider_id) DO UPDATE SET api_key = EXCLUDED.api_key`,
+		`UPDATE backup_settings SET secret_key = 'bucket-secret' WHERE id = true`,
 	}
 	for _, s := range seed {
 		if _, err := pool.Exec(ctx, s); err != nil {
@@ -97,6 +98,7 @@ func TestSealStoredSealsWhatIsInTheClear_Integration(t *testing.T) {
 			`DELETE FROM acquisition_services WHERE code = 'seal-test'`,
 			`UPDATE acoustid_settings SET api_key = NULL WHERE id = true`,
 			`UPDATE smtp_config SET password = '' WHERE id = true`,
+			`UPDATE backup_settings SET secret_key = '' WHERE id = true`,
 		} {
 			_, _ = pool.Exec(context.Background(), s)
 		}
@@ -115,6 +117,7 @@ func TestSealStoredSealsWhatIsInTheClear_Integration(t *testing.T) {
 		{secret.SubsonicPassword, u.ID.String(), "sub-pw"},
 		{secret.CoverArtAPIKey, "seal-test", "cover-key"},
 		{secret.TagProviderAPIKey, "seal-test", "tag-key"},
+		{secret.BackupSecretKey, "true", "bucket-secret"},
 	}
 	if len(want) != len(secret.Columns) {
 		t.Fatalf("the test covers %d columns, secret.Columns lists %d", len(want), len(secret.Columns))