fix: harden backup and restore compatibility

[RentnerKev]

Summary

Stabilize backup/restore compatibility before Beta.

Backups become increasingly important once users run public versions.

Goals

Validate:

• current backup format
• restore into current Beta
• restore after supported upgrades
• certificate/private key state
• application encryption key
• database state
• Caddy/runtime regeneration
• permissions
• interruption/failure handling

Compatibility

Define which older backup formats/releases remain supported.

Do not silently reinterpret incompatible formats.

Acceptance Criteria

• current backup → current restore
• Alpha-supported backup → Beta restore where promised
• HTTP/HTTPS traffic works after restore
• permissions correct
• no secret leakage
• failure behavior tested
• production smoke/release gate covers current path

Priority

P0

Dependencies and sequencing

Extends completed Alpha backup/upgrade work #34. Coordinate supported formats and encrypted state with #67 and #68, and security-sensitive restore paths with #72. Must be complete before #75 closes.

Alpha 4 prerequisite

Include the new Alpha 4 persistent certificate candidates, operations/events, retry state, host binding jobs, and deployment configuration from #77, #78, #81, #84 and #85. Alpha 4 restore coverage is a prerequisite, not completion of the broader Beta compatibility gate.