feat(clipboard): add encrypted backup and restore

[xcv58]

Adds encrypted Clipboard Backup under Clipboard → Local Data, with separate descriptive rows for backup, restore, and local rollback recovery. Users choose the archive or save location before entering a password. New backups require at least 12 characters and offer passphrase guidance; existing archives with shorter multibyte passwords remain readable. Saved Clips and Snippets are selected by default, while History requires explicit opt-in with its count, size, and privacy context. Portable .mactoolsclipboard archives remain separate from Preferences Backup and readable per-item Export.

Restore authenticates and stages the archive before previewing a default merge or a precisely scoped replacement. Replacement requires confirmation before changing local data; cancelling preserves the preview, and completed operations show only Done. Conflicting content receives a new ID, conflicting snippet keywords are disabled, and conflict and missing-file reports remain available after restoration. Replacement creates an encrypted local rollback snapshot and updates both persistent tables in one SQLite transaction.

The versioned format uses a fresh archive key, AES-256-GCM records, PBKDF2-HMAC-SHA256 key wrapping with bounded parameters, and an encrypted terminal manifest binding counts, scope, ordering, and digests. Processing runs one bounded record at a time off the main actor and re-encrypts data with the destination key. The design/security review and local verification guide are included in docs/.

Validation:

• Clipboard timeout/recovery integration tests allow two seconds for cold helper startup and retain the separate 50 ms deadline check. A controlled 150 ms startup delay reproduced the old recovery failure; all three checks then passed ten repetitions each. Production timeouts are unchanged.
• 64 focused clipboard helper, snippet replacement, backup service, presentation, and localization tests passed on the final revision, including Unicode character counting, legacy-password compatibility, cancellation, replacement-preview dismissal, and completion behavior.
• Adversarial coverage includes authentication/corruption/framing failures, all seven replacement scopes, ID and keyword conflicts, SQLite-full and injected commit failures, rollback recovery, destination-key verification, and archive exclusions. The 128 MiB synthetic archive memory and main-actor responsiveness regression passed.
• All 518 Clipboard strings, including 51 backup/restore strings, cover all 11 supported languages. All 5,698 compiled translations matched the source catalog. Runtime lookup checks cover every backup string in every language, and 44 synthetic dialog states were rendered; representative English, German, Russian, and Arabic layouts were visually inspected.
• Password fields stay within right-to-left layouts; counts and file sizes follow the app's runtime locale. Changelog validation and diff checks passed.
• Native save/open-panel interaction and an independent cryptographic audit remain manual review items. No shared Debug app was installed or synchronized.

Closes #394.