M1: key management, backup locations and occ commands

- migration: ngb_targets, ngb_runs, ngb_snapshots
- KeyService: master key stored encrypted with the instance secret
  (unattended backups), passphrase-wrapped copy in every repository and
  in the recovery kit, recorded admin confirmation per key fingerprint
- TargetService: locations built from files_external backends without a
  mount; files_external is loaded through IAppManager::loadApp() and its
  enabled state is left alone; credentials encrypted with ICrypto;
  existing repositories are adopted only if made with this key, and a
  repository cannot be registered twice
- Repository: initWithKey/openWithKey with an encrypted key check
- occ: backup:key:init|kit|confirm, backup:target:backends|add|list|remove

lib/Crypto/KeyRing.php

@@ -37,6 +37,11 @@ final class KeyRing {
 		return new self(sodium_crypto_kdf_keygen());
 	}
 
+	/** Raw master key, only for storing it encrypted on the server (ICrypto). */
+	public function exportMasterKey(): string {
+		return $this->masterKey;
+	}
+
 	public function dataKey(): string {
 		return $this->dataKey;
 	}