Add deterministic full-site backup archives with manifest.toml metadata, SQLite snapshotting, SHA-256 hashes, required runtime directories, media/assets coverage, and explicit opt-in Tor onion-service key handling.

Harden restore by treating archives as hostile input: validate entry types, paths, duplicate entries, manifest contents, hashes, settings, SQLite integrity, schema compatibility, and approved runtime roots before swapping live data. Stage restores in tmp, create pre-restore safety backups, serialize operations with a lock, roll back failed installs, and restrict restored Tor key permissions.

Expose the workflow through the admin Backups page with manual creation, admin-only downloads, restore-from-upload confirmation, automatic backup settings, retention controls, recent history, CSRF/admin auth, and no-JS-compatible forms. Add scheduled automatic backups disabled by default with settings.toml-compatible defaults.

Update README and changelog with usage, defaults, warnings, format details, and restore procedure. Add Rust coverage for manifest/hash validation, malicious archive rejection, staging, retention, Tor key include/exclude, rollback, config compatibility, and concurrent operation handling, plus ignored Playwright coverage for backup/download, fresh and populated restore, scheduler retention, malicious upload rejection, Firefox no-JS, and WebKit smoke.

Validation run: cargo fmt --all --check; cargo clippy --workspace --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic -D clippy::nursery -D clippy::cargo; cargo test --workspace --all-features; npx playwright test tests/playwright/backup_restore.spec.mjs --project=chromium; targeted Firefox no-JS and WebKit smoke Playwright runs.