feat(cloud-backup): mirror fleet snapshots to S3-compatible storage (#782)

* feat(cloud-backup): mirror fleet snapshots to S3-compatible storage

Add an Admiral-tier Cloud Backup feature that replicates every fleet
snapshot to off-site storage, with two provider modes that share the
same `@aws-sdk/client-s3` code path:

- Sencho Cloud Backup: zero-config, 500 MB allowance backed by
  Cloudflare R2, provisioned via the sencho.io worker against the
  user's Lemon Squeezy license.
- Custom S3 (BYOB): any S3-compatible bucket (AWS, MinIO, Backblaze
  B2, Wasabi, R2 with own keys), with credentials encrypted via
  `CryptoService` before storage.

API-triggered snapshots upload fire-and-forget so the UI returns
immediately; scheduled snapshots block on the upload so the task's
success/failure reflects cloud durability. Object keys include the
instance_id segment to prevent collisions when the same Admiral
license is activated on multiple Sencho instances.

* fix(cloud-backup): drop ES2022-only Error cause arg breaking ES2020 build

The backend tsconfig pins lib to ES2020. The two-argument
`Error(message, { cause })` form requires ES2022, so tsc rejected it
with TS2554. Revert to single-argument throw to match the
convention used elsewhere in the backend services.

backend/package.json

@@ -28,6 +28,7 @@
     "@types/multer": "^2.1.0",
     "@types/node": "^25.3.0",
     "@types/supertest": "^7.2.0",
+    "@types/tar-stream": "^3.1.4",
     "@types/yaml": "^1.9.6",
     "eslint": "^10.1.0",
     "nodemon": "^3.1.13",
@@ -39,6 +40,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-ecr": "^3.1019.0",
+    "@aws-sdk/client-s3": "^3.1037.0",
     "@types/compression": "^1.8.1",
     "@types/cors": "^2.8.19",
     "@types/dockerode": "^4.0.1",
@@ -69,6 +71,7 @@
     "otplib": "^12.0.1",
     "semver": "^7.7.4",
     "systeminformation": "^5.31.1",
+    "tar-stream": "^3.1.8",
     "ws": "^8.19.0",
     "yaml": "^2.8.2",
     "zod": "^4.3.6"