Add full /data backup export/import for server migration

- New admin endpoints: GET /api/admin-backup/export streams the entire
  data directory as tar.gz (after flushing queued writes); POST
  /api/admin-backup/import validates the archive, snapshots current
  data, replaces the folder, and reloads all in-memory state.
- Admin UI: "Full Data Backup" section with download and restore-from-
  file controls in the Analytics panel.
- Fix admin TOTP secret path to honor SITEFORGE_DATA_DIR (moved base
  path resolution to server/paths.js to avoid a circular import), so
  2FA for admin and study users survives backup/restore.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server.js

@@ -41,6 +41,7 @@ import { recordVisitor } from './server/routes/analytics.js'
 import { register as registerAdminAuth } from './server/routes/admin-auth.js'
 import { register as registerAdminContent } from './server/routes/admin-content.js'
 import { register as registerAdminAssets } from './server/routes/admin-assets.js'
+import { register as registerAdminBackup } from './server/routes/admin-backup.js'
 import { register as registerStudyAuth } from './server/routes/study-auth.js'
 import { register as registerStudyData } from './server/routes/study-data.js'
 import { register as registerStudyAccount } from './server/routes/study-account.js'
@@ -85,6 +86,7 @@ app.use((_req, res, next) => {
 registerAdminAuth(app)
 registerAdminContent(app)
 registerAdminAssets(app)
+registerAdminBackup(app)
 registerStudyAuth(app)
 registerStudyData(app)
 registerStudyAccount(app)