Add full /data backup export/import for server migration

- New admin endpoints: GET /api/admin-backup/export streams the entire
  data directory as tar.gz (after flushing queued writes); POST
  /api/admin-backup/import validates the archive, snapshots current
  data, replaces the folder, and reloads all in-memory state.
- Admin UI: "Full Data Backup" section with download and restore-from-
  file controls in the Analytics panel.
- Fix admin TOTP secret path to honor SITEFORGE_DATA_DIR (moved base
  path resolution to server/paths.js to avoid a circular import), so
  2FA for admin and study users survives backup/restore.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

package.json

@@ -34,7 +34,8 @@
     "react-router-dom": "^7.13.1",
     "react-simple-maps": "^3.0.0",
     "remark-gfm": "^4.0.1",
-    "resend": "^6.10.0"
+    "resend": "^6.10.0",
+    "tar": "^7.5.19"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.4",