refactor(js): extract auto-backup module from app.js monofile (§3.1)

Fifth slice of the app.js split. Moves the scheduled encrypted-backup
feature (config, retention, runAutoBackupNow/runAutoBackupIfDue) to
js/app.backup.js. Pure declarations + two consts, no top-level side effects
→ loads before app.js; uses encryptExportPayload (app.import.js), Bridge,
api, state via shared global scope at call time.

- Byte-for-byte identical extraction; no duplicate const; no top-level
  backup reference left in app.js; syntax OK on all six app parts.
- index.html + BuildAssets whitelist + harness APP_PARTS updated; assets
  regenerated (manifest embeds all 7 ordered JS files).
- 55/55 tests green.

app.js: 11936 → 9900 lines — now under 10k. Five modules extracted
(~2000 lines): argon2 → crypto → totp → import → backup → app → sync.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CODE_AUDIT.md

@@ -236,10 +236,13 @@ réécriture des call-sites, risque quasi nul vs conversion en modules ES).
 - ✅ `js/app.totp.js` extrait (TOTP RFC 6238 + crypto TOTP/custom-fields) —
   byte-for-byte identique, chargé AVANT app.js. **+13 tests TOTP (vecteurs
   RFC 6238)** ajoutés en même temps → extraction *et* nouvelle couverture.
-- `app.js` : 11 936 → **10 138 lignes** (crypto + totp + sync + import sortis).
+- ✅ `js/app.backup.js` extrait (auto-backup planifié) — byte-for-byte
+  identique, chargé AVANT app.js (pures déclarations).
+- `app.js` : 11 936 → **9 900 lignes** (crypto + totp + import + backup + sync
+  sortis — 5 modules).
 - Suite de tests : 42 → **55 tests**.
 - Reste à extraire (grosses sections cohésives) : slideover, settings,
-  quicksearch, autofill, auto-backup, favicons…
+  quicksearch, autofill, favicons, vault-health…
 - ✅ `node --check` en pré-étape de `BuildAssets.ps1` : **déjà fait** (cf. §3.2).
 
 ### 3.2 🟡 Aucun test automatisé — **partiellement adressé (2026-07-04)**