feat(backup): admin-tunable retention + BACKUP_KEY as a Komodo secret

Retention (keep-last / keep-daily-days) is operational policy the on-site admin
should tune, not a server env var requiring a redeploy -- same reasoning that moved
the target directory to the UI.

- Migration 0017: site_config.backup_keep_last + backup_keep_daily_days (nullable;
  null = code default 7 / 30 per field).
- BackupService reads retention fresh each run; status() exposes keepLast +
  keepDailyDays. DEFAULT_BACKUP_RETENTION is now a pure code default (env reads gone).
- PUT /api/backup/config accepts keepLast / keepDailyDays (non-negative int, or null
  to reset to default; 400 on negative).
- UI: two retention fields on the Backup config card; one Save covers target +
  retention. i18n sq + en.

BACKUP_KEY wired into Komodo:
- komodo/resources.toml: BACKUP_KEY=[[park_buzi_backup_key]] (per-booth secret,
  alongside JWT / signing keys).
- komodo/.env.komodo.example: documents it as the ONLY backup env var -- escrow it
  offsite alongside EVENT_SIGNING_KEY (recovery needs both); target + retention are
  admin-chosen in the UI / DB, not env. Server .env.example trimmed to just BACKUP_KEY.

Also carries the small in-progress setup-intro i18n copy trim.

Tests: 218 server tests green, incl. retention persist / reset-to-default / reject-
negative and the updated status shape. Migration applies cleanly (needed a
statement-breakpoint between the two ALTERs). Wiki backup-recovery updated.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/log.md

@@ -1948,3 +1948,17 @@ status panel (distinct amber "BACKUP_KEY missing" warning) + Back-up-now + resto
 i18n sq+en; nav.backup. Verified live with Playwright: typed path → Test "writable" → Save persisted →
 status reflects it + key-missing warning shown. build/lint/test green (whole monorepo). Updated
 [[backup-recovery]] as-built + [[open-questions]] #5.
+
+## [2026-06-29] feat | Backup retention admin-tunable + BACKUP_KEY wired into Komodo
+Same reasoning as the target dir: backup retention is operational policy the on-site admin tunes, not a
+server env var requiring a redeploy. Moved BACKUP_KEEP_LAST/BACKUP_KEEP_DAILY_DAYS env → site_config
+(migration 0017: backup_keep_last, backup_keep_daily_days, both nullable → code default 7/30 per field).
+BackupService reads retention fresh each run; status() now exposes keepLast/keepDailyDays. PUT
+/api/backup/config extended to accept keepLast/keepDailyDays (non-negative int or null=reset-to-default,
+400 on negative). UI: two retention number fields on the Backup config card, one Save covers target +
+retention; i18n sq+en. DEFAULT_BACKUP_RETENTION is now a pure code default (env reads dropped). Komodo:
+BACKUP_KEY wired as a per-booth secret ([[park_buzi_backup_key]] in komodo/resources.toml; documented in
+komodo/.env.komodo.example as the ONLY backup env var — target+retention are UI/DB). Server .env.example
+trimmed to just BACKUP_KEY. build/lint/test green (218 server tests, incl. retention persist/reset/negative
++ updated status shape). NOTE: dev API process was down after this round (live process, not code) — verified
+via the full test harness, not a live click-through this time. Updated [[backup-recovery]] as-built.