feat(recovery): add safe-mode recovery surface and emergency CLI (#1286)

* feat(recovery): add safe-mode recovery surface and emergency CLI

Add a read-only Recovery tab under Settings (admin-only) backed by a new
GET /api/diagnostics endpoint reporting app version, database integrity,
encryption-key status, Docker reachability, account and SSO counts, and
non-secret configuration. The endpoint loads without Docker or live metrics
so it stays available when the dashboard does not, requires a genuine admin
session, and builds its config block from a non-secret allowlist so no
credentials are ever exposed.

Expand the emergency command-line toolkit beyond the two-factor reset with
seven host-level commands: reset-password, create-emergency-admin,
clear-sessions, disable-sso, diagnostics, validate-db, and backup-data. Each
prints its result, exits with a meaningful status code, and writes an audit
entry where it changes state.

Document the toolkit in a new operator guide and link it from the recovery
and two-factor pages.

* feat(recovery): download the emergency command reference as a text file

The recovery commands are needed exactly when the dashboard is unreachable,
so reading them only in-app is a chicken-and-egg problem. Add a Download
button to the command-line section that saves the full
`docker compose exec sencho ...` reference as a text file, letting operators
keep it on hand before they need it. Reuses a shared download helper with the
existing diagnostics export.

* fix(recovery): harden diagnostics, backup, and emergency-admin against edge cases

Address findings from an independent review of the recovery toolkit:

- DiagnosticsService now degrades instead of throwing when a queried table is
  missing or corrupt: each read falls back and is folded into database.ok, so a
  broken database reports "problem detected" rather than failing the whole
  endpoint or showing a misleading healthy state with zeroed counts.
- backup-data refuses a destination that resolves to the live database, which
  would otherwise report success while producing no separate copy.
- create-emergency-admin now applies the same username rule as the user-
  management route, extracted to a shared helper so both stay in sync.

Adds tests for a missing read table, a malformed emergency-admin username, and
the backup same-target rejection.

backend/src/cli/_shared.ts

@@ -0,0 +1,56 @@
+/**
+ * Shared helpers for the emergency recovery CLI commands in this directory.
+ * Each command exports a testable function and a thin `main()` wrapper; these
+ * helpers carry the audit-write and exit-code conventions so the individual
+ * commands stay focused on their own logic.
+ */
+import { DatabaseService } from '../services/DatabaseService';
+
+export interface CliResult {
+    ok: boolean;
+    message: string;
+}
+
+/**
+ * Record a CLI action in the audit log with the conventional `cli` actor, then
+ * flush immediately. The buffer's 1s flush timer never fires because the CLI
+ * process exits first, so the explicit flush is what persists the entry. An
+ * audit-write failure is logged but never aborts the action it was recording.
+ */
+export function auditCli(db: DatabaseService, path: string, summary: string): void {
+    try {
+        db.insertAuditLog({
+            timestamp: Date.now(),
+            username: 'cli',
+            method: 'POST',
+            path,
+            status_code: 200,
+            node_id: null,
+            ip_address: 'cli',
+            summary,
+        });
+        // Flush inside the try: the buffer's 1s timer never fires before the
+        // CLI exits, so this is what persists the entry. Keeping it under the
+        // same catch means a broken DB handle cannot throw a second, uncaught
+        // error after the recovery action it records has already succeeded.
+        db.flushAuditLogBuffer();
+    } catch (err) {
+        console.warn(`[cli] audit log write failed: ${(err as Error).message}`);
+    }
+}
+
+/** Print the result and exit 0 (ok) or 1 (error), matching resetMfa.ts. */
+export function exitWith(result: CliResult): never {
+    if (result.ok) {
+        console.log(result.message);
+        process.exit(0);
+    }
+    console.error(result.message);
+    process.exit(1);
+}
+
+/** Print a usage error to stderr and exit 2 (matches resetMfa.ts). */
+export function usage(message: string): never {
+    console.error(message);
+    process.exit(2);
+}