feat: add generic read-only file mounts for targets

[davidborzek]

Summary

Targets get a new files: [{source, target}] field: each host file is bind-mounted read-only into every mover of that target. Today only the restic password (passwordFile) and AWS credentials (credentialsFile) can reach the mover as files; anything else (CA certificates, SSH keys, known_hosts, rclone config, cloud key files) had to go through env, where it is visible via docker inspect or simply doesn't fit. sabon sets no env for these files; the user references the in-mover path from env or resticArgs. This is the groundwork for SFTP/rclone-based backends.

Validation: source must be a clean absolute path to a regular file (checked before each run; unclean paths are rejected because Docker path.Cleans bind sources, so a symlink before .. would otherwise stat one file and mount another). target must be absolute, unique, without :, and must not overlap sabon's own mounts (/data, /repo, /cache, /restore, /run/secrets/sabon-*) in either direction. A test keeps the reserved list in api in sync with the mount constants in internal/backup.

Existing fields are unchanged. passwordFile/credentialsFile share the unclean-path quirk; that is left for a separate fix.

Checklist

• gofmt, go vet ./..., and go test ./... pass
• Tests added/updated for behavioural changes
• Docs updated if behaviour or configuration changed
• Conventional Commit style used for the title