M4: admin settings page and JSON API

- AdminApiController (admin only, CSRF-protected): status, create key,
  download recovery kit, confirm (statement accepted + exact phrase),
  backends with their usable auth mechanisms, add/test/remove locations,
  start backups, schedule, snapshots, browse, queue restores
- RestoreJob runs web-initiated restores in the background; backup and
  restore runs are kept apart in the run table
- admin section 'NG Backup' with a Vue 3 / @nextcloud/vue 9 page: key and
  recovery-kit flow (download, tick statement, 'Yes, I confirm'), location
  form built from files_external's parameter definitions, schedule, run
  list with polling, snapshot browser and restore with the three modes
- auth mechanisms that depend on a user session or on files_external's
  own stored credentials are not offered

API tested with curl on NC34 (status, backends, schedule validation,
confirmation refusal, browse, queued restore and backup completed by
cron); non-admins get 403, anonymous 401.

src/components/Backups.vue

@@ -0,0 +1,91 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 Dillard Blom
+  - SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+<template>
+	<NcSettingsSection :name="t('ng_backup', 'Backups')"
+		:description="t('ng_backup', 'Backups run in the background through Nextcloud\'s cron. Unchanged files are not read again; only new data is uploaded.')">
+		<div class="ngb-row">
+			<NcTextField v-model="schedule" class="ngb-time" :label="t('ng_backup', 'Daily at (HH:MM, empty = off)')" />
+			<NcButton :disabled="schedule === status.schedule" @click="saveSchedule">{{ t('ng_backup', 'Save') }}</NcButton>
+		</div>
+		<div class="ngb-row">
+			<NcButton v-for="target in status.targets" :key="target.id" :disabled="isRunning(target.id)" @click="start(target)">
+				{{ isRunning(target.id) ? t('ng_backup', 'Backup to {name} running …', { name: target.name }) : t('ng_backup', 'Back up now to {name}', { name: target.name }) }}
+			</NcButton>
+		</div>
+		<NcNoteCard v-if="error" type="error">{{ error }}</NcNoteCard>
+
+		<table v-if="status.runs.length" class="ngb-table">
+			<thead>
+				<tr>
+					<th>{{ t('ng_backup', 'Started') }}</th>
+					<th>{{ t('ng_backup', 'Location') }}</th>
+					<th>{{ t('ng_backup', 'Kind') }}</th>
+					<th>{{ t('ng_backup', 'Status') }}</th>
+					<th>{{ t('ng_backup', 'Files') }}</th>
+					<th>{{ t('ng_backup', 'Uploaded') }}</th>
+				</tr>
+			</thead>
+			<tbody>
+				<tr v-for="run in status.runs" :key="run.id" :title="run.error || ''">
+					<td>{{ new Date(run.startedAt * 1000).toLocaleString() }}</td>
+					<td>{{ targetName(run.targetId) }}</td>
+					<td>{{ run.kind }}</td>
+					<td :class="'ngb-' + run.status">{{ run.status }}{{ run.status === 'running' ? ' (' + run.phase + ')' : '' }}{{ run.error ? ': ' + run.error : '' }}</td>
+					<td>{{ run.stats?.files?.files ?? run.stats?.restored ?? '' }}</td>
+					<td>{{ run.stats?.files ? formatSize(run.stats.files.uploaded) : '' }}</td>
+				</tr>
+			</tbody>
+		</table>
+	</NcSettingsSection>
+</template>
+
+<script setup>
+import { ref, watch } from 'vue'
+import { t } from '@nextcloud/l10n'
+import NcButton from '@nextcloud/vue/components/NcButton'
+import NcNoteCard from '@nextcloud/vue/components/NcNoteCard'
+import NcSettingsSection from '@nextcloud/vue/components/NcSettingsSection'
+import NcTextField from '@nextcloud/vue/components/NcTextField'
+import api from '../api.js'
+import { formatSize } from '../format.js'
+
+const props = defineProps({ status: { type: Object, required: true } })
+const emit = defineEmits(['changed'])
+const schedule = ref(props.status.schedule)
+const error = ref('')
+watch(() => props.status.schedule, (s) => { schedule.value = s })
+
+const isRunning = (targetId) => props.status.runs.some(r => r.targetId === targetId && r.kind === 'full' && r.status === 'running')
+const targetName = (id) => props.status.targets.find(tg => tg.id === id)?.name ?? '#' + id
+
+async function start(target) {
+	error.value = ''
+	try {
+		await api.startBackup(target.id, '')
+		emit('changed')
+	} catch (e) {
+		error.value = e.message
+	}
+}
+
+async function saveSchedule() {
+	error.value = ''
+	try {
+		await api.setSchedule(schedule.value.trim())
+		emit('changed')
+	} catch (e) {
+		error.value = e.message
+	}
+}
+</script>
+
+<style scoped>
+.ngb-row { display: flex; gap: 8px; align-items: flex-end; flex-wrap: wrap; margin-bottom: 12px; }
+.ngb-time { max-width: 260px; }
+.ngb-table { width: 100%; border-collapse: collapse; }
+.ngb-table th, .ngb-table td { text-align: start; padding: 4px 8px; border-bottom: 1px solid var(--color-border); }
+.ngb-failed { color: var(--color-error-text); }
+.ngb-done { color: var(--color-success-text); }
+</style>