M4: admin settings page and JSON API

- AdminApiController (admin only, CSRF-protected): status, create key,
  download recovery kit, confirm (statement accepted + exact phrase),
  backends with their usable auth mechanisms, add/test/remove locations,
  start backups, schedule, snapshots, browse, queue restores
- RestoreJob runs web-initiated restores in the background; backup and
  restore runs are kept apart in the run table
- admin section 'NG Backup' with a Vue 3 / @nextcloud/vue 9 page: key and
  recovery-kit flow (download, tick statement, 'Yes, I confirm'), location
  form built from files_external's parameter definitions, schedule, run
  list with polling, snapshot browser and restore with the three modes
- auth mechanisms that depend on a user session or on files_external's
  own stored credentials are not offered

API tested with curl on NC34 (status, backends, schedule validation,
confirmation refusal, browse, queued restore and backup completed by
cron); non-admins get 403, anonymous 401.

lib/BackgroundJob/RestoreJob.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\BackgroundJob;
+
+use OCA\NgBackup\Db\Run;
+use OCA\NgBackup\Db\RunMapper;
+use OCA\NgBackup\Service\RestoreService;
+use OCA\NgBackup\Service\TargetService;
+use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\BackgroundJob\QueuedJob;
+use Psr\Log\LoggerInterface;
+
+/** Runs a restore requested from the web interface, outside the web request. */
+class RestoreJob extends QueuedJob {
+	public function __construct(
+		ITimeFactory $time,
+		private RunMapper $runs,
+		private TargetService $targets,
+		private RestoreService $restore,
+		private LoggerInterface $logger,
+	) {
+		parent::__construct($time);
+	}
+
+	protected function run($argument): void {
+		$run = $this->runs->find((int)$argument['run']);
+		if ($run->getStatus() !== Run::RUNNING) {
+			return;
+		}
+		$req = json_decode($run->getState(), true, 512, JSON_THROW_ON_ERROR);
+		$run->setPhase('restoring');
+		$run->setUpdatedAt(time());
+		$this->runs->update($run);
+		@set_time_limit(0);
+		try {
+			$result = $this->restore->restoreUserFiles($this->targets->get((string)$run->getTargetId()), $req['snapshot'], $req['path'], $req['mode']);
+			$run->setStatus(Run::DONE);
+			$run->setPhase('done');
+			$run->setStats(json_encode($result, JSON_THROW_ON_ERROR));
+		} catch (\Throwable $e) {
+			$this->logger->error('NG Backup restore ' . $run->getId() . ' failed: ' . $e->getMessage(), ['exception' => $e]);
+			$run->setStatus(Run::FAILED);
+			$run->setError($e->getMessage());
+		}
+		$run->setFinishedAt(time());
+		$run->setUpdatedAt(time());
+		$this->runs->update($run);
+	}
+}