M1: key management, backup locations and occ commands

- migration: ngb_targets, ngb_runs, ngb_snapshots
- KeyService: master key stored encrypted with the instance secret
  (unattended backups), passphrase-wrapped copy in every repository and
  in the recovery kit, recorded admin confirmation per key fingerprint
- TargetService: locations built from files_external backends without a
  mount; files_external is loaded through IAppManager::loadApp() and its
  enabled state is left alone; credentials encrypted with ICrypto;
  existing repositories are adopted only if made with this key, and a
  repository cannot be registered twice
- Repository: initWithKey/openWithKey with an encrypted key check
- occ: backup:key:init|kit|confirm, backup:target:backends|add|list|remove

lib/Db/Target.php

@@ -0,0 +1,40 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Db;
+
+use OCP\AppFramework\Db\Entity;
+
+/**
+ * @method string getName()
+ * @method void setName(string $v)
+ * @method string getBackend()
+ * @method void setBackend(string $v)
+ * @method string getAuth()
+ * @method void setAuth(string $v)
+ * @method string getOptions()
+ * @method void setOptions(string $v)
+ * @method string getBasePath()
+ * @method void setBasePath(string $v)
+ * @method string|null getRepositoryId()
+ * @method void setRepositoryId(?string $v)
+ * @method int getCreatedAt()
+ * @method void setCreatedAt(int $v)
+ */
+class Target extends Entity {
+	protected string $name = '';
+	protected string $backend = '';
+	protected string $auth = '';
+	protected string $options = '';
+	protected string $basePath = '';
+	protected ?string $repositoryId = null;
+	protected int $createdAt = 0;
+
+	public function __construct() {
+		$this->addType('createdAt', 'integer');
+	}
+}