refactor(js): extract auto-backup module from app.js monofile (§3.1)

Fifth slice of the app.js split. Moves the scheduled encrypted-backup
feature (config, retention, runAutoBackupNow/runAutoBackupIfDue) to
js/app.backup.js. Pure declarations + two consts, no top-level side effects
→ loads before app.js; uses encryptExportPayload (app.import.js), Bridge,
api, state via shared global scope at call time.

- Byte-for-byte identical extraction; no duplicate const; no top-level
  backup reference left in app.js; syntax OK on all six app parts.
- index.html + BuildAssets whitelist + harness APP_PARTS updated; assets
  regenerated (manifest embeds all 7 ordered JS files).
- 55/55 tests green.

app.js: 11936 → 9900 lines — now under 10k. Five modules extracted
(~2000 lines): argon2 → crypto → totp → import → backup → app → sync.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

delphi-backend/assets/assets.inc

@@ -1,12 +1,13 @@
 // Auto-generated by BuildAssets.ps1 - do not edit by hand.
 const
-  EMBEDDED_ASSET_COUNT = 8;
+  EMBEDDED_ASSET_COUNT = 9;
   EMBEDDED_ASSETS: array[0..EMBEDDED_ASSET_COUNT-1] of TEmbeddedAsset = (
     (UrlPath: '/index.html'; ResName: 'INDEX_HTML'),
     (UrlPath: '/js/argon2.js'; ResName: 'JS_ARGON2_JS'),
     (UrlPath: '/js/app.crypto.js'; ResName: 'JS_APP_CRYPTO_JS'),
     (UrlPath: '/js/app.totp.js'; ResName: 'JS_APP_TOTP_JS'),
     (UrlPath: '/js/app.import.js'; ResName: 'JS_APP_IMPORT_JS'),
+    (UrlPath: '/js/app.backup.js'; ResName: 'JS_APP_BACKUP_JS'),
     (UrlPath: '/js/app.js'; ResName: 'JS_APP_JS'),
     (UrlPath: '/js/app.sync.js'; ResName: 'JS_APP_SYNC_JS'),
     (UrlPath: '/css/style.css'; ResName: 'CSS_STYLE_CSS')