Backend review fixes (stages B1/B2): salted master KDF, AAD-bound ciphertexts, hardened destructive endpoints ...

- crypto: master-key derivation is now scrypt (n=2^15) with a per-install
  salt (GNEXUS_CREDS_MASTER_KEY_SALT); plain sha256 kept as the legacy
  path so pre-salt data still decrypts; salt is mandatory in production
- crypto: encrypted field envelopes are now bound by aad to
  "<user_id>:<secret_id>:<version_id>" (pre-generated version ids) so a
  ciphertext transplanted between rows of the same user fails auth
  instead of silently decrypting; unbound legacy envelopes decrypt
  through a single fallback and are re-bound by scripts/migrate-crypto.py
- secrets.notes widened 140 -> 255 (model, schemas, alembic 0002)
- list_secrets: sort_by restricted to a column whitelist (422 otherwise);
  limit clamp aligned with the API layer (1..200)
- update_secret: tag normalization moved to schemas.normalize_tags; the
  metadata audit now records the tags diff BEFORE the rows change (the
  old value used to be read after the rows were cleared)
- DELETE /account-data now requires Scope.admin (ui channel unaffected)
  plus the sensitive rate limiter, and audits the deleted count
- POST /import caps payload.secrets at 1000
- POST /admin/restore takes a typed payload and resolves the filename
  against the backup listing; restore_backup itself refuses files
  outside the backup dir
- production settings: master_key_salt required, wildcard cors_origins
  rejected
- tests: 62 -> 78 (crypto KDF/aad, sort whitelist, notes cap, import cap,
  account-data scopes, restore validation, config prod rules)

Co-Authored-By: Claude Code <noreply@anthropic.com>

Per-service locale override: effective locale chain, PATCH /me validation ...

users.locale is now purely the per-service override chosen in settings;
the auth-derived default lives in users.profile.locale and is never
written back over the override by login or the webhook. PATCH /me
normalizes language tags (en-US -> en), accepts auto to clear, and
rejects unsupported locales with 422. UserRead gains locale_effective
(override -> profile -> en) which the web UI and the extension use as
their UI language. The validation error handler strips non-serializable
pydantic ctx.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Production-ready rewrite: UI kit integration, admin backups, sorting, profile editing, and security hardening ...

- Frontend: complete rewrite using gnexus-ui-kit components (GnNavigationShell,
  GnTable, GnTimeline, GnModal, GnToastProvider, GnSkeleton, etc.)
- Frontend: browser route sync (/secrets/:id, /audit/:id), pagination,
  real-time search debounce, skeleton loading states, retry with backoff
- Frontend: profile editing modal, token creation with scope selection,
  import/export, settings metrics, admin users table
- Backend: backup/restore endpoints for PostgreSQL and SQLite via pg_dump/psql
- Backend: admin backup CRUD, file download endpoint
- Backend: stats endpoint, PATCH /me profile endpoint, CORS middleware,
  graceful shutdown logging
- Backend: table sorting (sort_by/sort_dir) in list_secrets
- Backend: OAuth return_to validation, rate limiting on sensitive endpoints
- MCP: validation fixes, tool description improvements, protocol cleanup
- Tests: 44 passing including new backup test suite
- Docker: add postgresql-client, backups volume, deployment docs
- Docs: backup/restore instructions in deployment guide

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Harden API token tracking and test coverage

Close REST MCP and ops documentation gaps

Fix OAuth callback expiry handling

Harden export import auth and MCP access

Implement initial gnexus-creds MVP scaffold