Administration backs the server up, downloads, uploads and restores it

A Backups section (for administrators, PrivaPub's /clientapi/admin/backups): the backups kept with their kind, size,
media and the logins deleted since, what runs, the restore waiting and the last restore's report. Back up now; download
for the password through a link good for ten minutes, which the browser saves to disk; upload a downloaded backup in
pieces straight from the picked file (js/transfer.js PUTs file.slice at the offset PrivaPub has, never through .NET's
memory, and carries on after a refused or lost piece); delete after asking; restore for the password and the host typed
out, saying what it keeps and what it loses, then showing PrivaPub restarting until the ended session sends the page to
sign in.

e2e: a backup made, downloaded and uploaded again; and, only with --filter "Category=Restore", a real restore of the
pasture, which signs the town in again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

CLAUDE.md

@@ -95,6 +95,9 @@ tests/e2e/run.sh [--filter ...]   # publishes with WasmApplicationEnvironmentNam
   - An idle globe draws no frame.
 
   Photos and stats go to `tests/e2e/out/globe/`.
+- **Restore** (`Category=Restore`, in `Actions/BackupsTests.cs`): a real restore of the pasture from Administration. It
+  ends every session, the town's too, so it runs only when asked (`--filter "Category=Restore"`, never next to other
+  tests) and signs the town in again (`town.sh renew privapub`). Normal runs use `--filter "Category!=Perf&Category!=Restore"`.
 - **Perf** (`Perf/`, `Category=Perf`, left out of the normal runs with `--filter "Category!=Perf"`): `FeedPerfTests`
   scrolls load0's home (thousands of posts from SocialPub's `load.sh`) to 2000 posts and writes, per step, the time,
   DOM nodes, JS and .NET heaps and long tasks to `perf.json`.
@@ -379,8 +382,16 @@ supplies:
   and bookmarks exported and imported as the CSV files Mastodon writes, so a persona moves between servers. An import
   resolves each row through PrivaPub and acts one row at a time; it can be stopped.
 - **Administration** (`Pages/Administration.razor`, `Components/Admin/`, for moderators): reports, then for
-  administrators the servers blocked for everyone and the federation statistics. PrivaPub has no admin list of users,
-  and adding an admin endpoint waits for the owner, so the Users section stays empty.
+  administrators the servers blocked for everyone, the federation statistics and the backups. PrivaPub has no admin list
+  of users, and adding an admin endpoint waits for the owner, so the Users section stays empty.
+- **Backups** (`Components/Admin/BackupsPanel.razor`, `/clientapi/admin/backups`; owner decision 2026-10-07): the server's
+  backups (nightly, before each deploy, made here, uploaded), with what runs and the last restore's report.
+  - A download asks for the password and gives a link good for ten minutes, a plain anchor, so the browser saves the tar
+    to disk.
+  - An upload never passes through .NET's memory: `wwwroot/js/transfer.js` PUTs `file.slice` pieces at the offset PrivaPub
+    has, and carries on from what PrivaPub says after a refused or lost piece.
+  - A restore asks for the password and the server's host typed out, and says what it means. PrivaPub stops, restores as
+    it starts again and ends every session, so the page shows it restarting until the ended session sends it to sign in.
 - **Notification policy** (`Components/Settings/NotificationPolicyEditor.razor`, in Settings and at `/notifications/filtered`):
   what notifications from people the persona does not follow, people who do not follow it, new accounts, private
   mentions it did not ask for and limited accounts become (accept, filter, drop; `/api/v2/notifications/policy`), and the