The Backups page takes the snapshot destination: bucket and keys sealed in the forge, not plaintext in its environment #338

The snapshot destination is read from the process environment (S3_ENDPOINT, S3_BUCKET, S3_ACCESS_KEY, S3_SECRET_KEY, S3_REGION in src/snapshot/store.ts) and the Backups page only shows status. An operator with their own bucket has to edit the deployment.

Intent: the Backups page accepts the destination, seals the keys (secrets table or app_env-style rows), and the env remains a fallback for a host-provisioned forge.

Acceptance:

• [ ] a Backups form: endpoint, bucket, region, access key, secret key (write-only), test button that lists the bucket and reports the result in one sentence
• [ ] precedence: sealed settings over env; the page says which is in effect
• [ ] the nightly snapshot and the restore path read through one resolver
• [ ] tests for precedence and for a failed test-connection message

Files: src/snapshot/store.ts, src/web/pages/settings.ts (Backups), src/core/secret_store.ts. Depends on the secrets table. One run.