M1: key management, backup locations and occ commands

- migration: ngb_targets, ngb_runs, ngb_snapshots
- KeyService: master key stored encrypted with the instance secret
  (unattended backups), passphrase-wrapped copy in every repository and
  in the recovery kit, recorded admin confirmation per key fingerprint
- TargetService: locations built from files_external backends without a
  mount; files_external is loaded through IAppManager::loadApp() and its
  enabled state is left alone; credentials encrypted with ICrypto;
  existing repositories are adopted only if made with this key, and a
  repository cannot be registered twice
- Repository: initWithKey/openWithKey with an encrypted key check
- occ: backup:key:init|kit|confirm, backup:target:backends|add|list|remove

lib/Command/KeyConfirm.php

@@ -0,0 +1,52 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Command;
+
+use OCA\NgBackup\Service\KeyService;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Question\Question;
+
+class KeyConfirm extends Command {
+	public const STATEMENT = 'I have downloaded the recovery kit and stored it safely, outside this server. '
+		. 'I understand that keeping these keys safe is my own responsibility and that backups cannot be restored without them.';
+	public const CONFIRMATION = 'Yes, I confirm';
+
+	public function __construct(
+		private KeyService $keys,
+	) {
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		$this->setName('backup:key:confirm')
+			->setDescription('Confirm that the recovery kit is stored safely (required before the first backup)')
+			->addOption('user', 'u', InputOption::VALUE_REQUIRED, 'Admin user id recorded with the confirmation', 'occ');
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		if (!$this->keys->isInitialized()) {
+			$output->writeln('<error>No backup key yet: run occ backup:key:init first.</error>');
+			return 1;
+		}
+		$output->writeln('Key fingerprint: <info>' . $this->keys->fingerprint() . '</info>');
+		$output->writeln('');
+		$output->writeln(wordwrap(self::STATEMENT, 78));
+		$output->writeln('');
+		$answer = (string)$this->getHelper('question')->ask($input, $output, new Question('Type "' . self::CONFIRMATION . '" to proceed: '));
+		if (trim($answer) !== self::CONFIRMATION) {
+			$output->writeln('<error>Not confirmed.</error>');
+			return 1;
+		}
+		$this->keys->confirmRecoveryKit((string)$input->getOption('user'));
+		$output->writeln('Confirmed. Backups can now run.');
+		return 0;
+	}
+}