refactor(js): extract auto-backup module from app.js monofile (§3.1)

Fifth slice of the app.js split. Moves the scheduled encrypted-backup
feature (config, retention, runAutoBackupNow/runAutoBackupIfDue) to
js/app.backup.js. Pure declarations + two consts, no top-level side effects
→ loads before app.js; uses encryptExportPayload (app.import.js), Bridge,
api, state via shared global scope at call time.

- Byte-for-byte identical extraction; no duplicate const; no top-level
  backup reference left in app.js; syntax OK on all six app parts.
- index.html + BuildAssets whitelist + harness APP_PARTS updated; assets
  regenerated (manifest embeds all 7 ordered JS files).
- 55/55 tests green.

app.js: 11936 → 9900 lines — now under 10k. Five modules extracted
(~2000 lines): argon2 → crypto → totp → import → backup → app → sync.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -35,6 +35,7 @@ js/argon2.js      (IIFE, globalThis.NobleArgon2)
 js/app.crypto.js  (KDF, verifier, encrypt/decrypt — extrait §3.1)
 js/app.totp.js    (TOTP RFC 6238 + TOTP/custom-field crypto — extrait §3.1)
 js/app.import.js  (export container + import CSV/JSON — extrait §3.1)
+js/app.backup.js  (auto-backup planifié — extrait §3.1)
 js/app.js         (le reste : state, Bridge, api, UI…)
 js/app.sync.js    (WebDAV + merge — extrait §3.1, APRÈS app.js car
                    effet de bord top-level `Bridge.onWebdavResult = …`)
@@ -103,6 +104,7 @@ seule `api()` est stubbée).
 | Crypto frontend (KDF, verifier, AES-GCM) — extrait §3.1 | `js/app.crypto.js` |
 | TOTP (RFC 6238) + TOTP/custom-field crypto — extrait §3.1 | `js/app.totp.js` |
 | Import/export frontend (CSV/JSON parse, export container) — extrait §3.1 | `js/app.import.js` |
+| Auto-backup frontend (planifié, chiffré) — extrait §3.1 | `js/app.backup.js` |
 | Sync frontend (WebDAV, snapshot, merge) — extrait §3.1 | `js/app.sync.js` |
 | Argon2id vendé (bundle `@noble/hashes`, IIFE) | `js/argon2.js` |
 | HTML racine | `index.html` |