M4: admin settings page and JSON API

- AdminApiController (admin only, CSRF-protected): status, create key,
  download recovery kit, confirm (statement accepted + exact phrase),
  backends with their usable auth mechanisms, add/test/remove locations,
  start backups, schedule, snapshots, browse, queue restores
- RestoreJob runs web-initiated restores in the background; backup and
  restore runs are kept apart in the run table
- admin section 'NG Backup' with a Vue 3 / @nextcloud/vue 9 page: key and
  recovery-kit flow (download, tick statement, 'Yes, I confirm'), location
  form built from files_external's parameter definitions, schedule, run
  list with polling, snapshot browser and restore with the three modes
- auth mechanisms that depend on a user session or on files_external's
  own stored credentials are not offered

API tested with curl on NC34 (status, backends, schedule validation,
confirmation refusal, browse, queued restore and backup completed by
cron); non-admins get 403, anonymous 401.

src/api.js

@@ -0,0 +1,32 @@
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import axios from '@nextcloud/axios'
+import { generateUrl } from '@nextcloud/router'
+
+const url = (path) => generateUrl('/apps/ng_backup/api' + path)
+
+/** Unwraps {error} responses into thrown Errors with the server's message. */
+async function call(method, path, data) {
+	try {
+		const response = await axios({ method, url: url(path), data, params: method === 'get' ? data : undefined })
+		return response.data
+	} catch (e) {
+		throw new Error(e.response?.data?.error || e.message)
+	}
+}
+
+export default {
+	status: () => call('get', '/status'),
+	initKey: (passphrase) => call('post', '/key', { passphrase }),
+	kitUrl: () => url('/key/kit'),
+	confirmKit: (accepted, phrase) => call('post', '/key/confirm', { accepted, phrase }),
+	backends: () => call('get', '/backends'),
+	addTarget: (target) => call('post', '/targets', target),
+	removeTarget: (id) => call('delete', `/targets/${id}`),
+	testTarget: (id) => call('post', `/targets/${id}/test`),
+	startBackup: (targetId, label) => call('post', '/backups', { targetId, label }),
+	setSchedule: (time) => call('put', '/schedule', { time }),
+	snapshots: (targetId) => call('get', `/targets/${targetId}/snapshots`),
+	browse: (targetId, snapshotId, path) => call('get', `/targets/${targetId}/snapshots/${snapshotId}/browse`, { path }),
+	startRestore: (targetId, snapshotId, path, mode) => call('post', '/restores', { targetId, snapshotId, path, mode }),
+}