Add local backup retention: keep-local toggle, download, delete-local

Lets operators opt into keeping the local archive after upload (global
keep_local_backups setting), pull a remote archive back down into the
Proxmox dump directory for manual restore, and drop a locally-retained
copy without touching the remote object. Consolidates deletion so
retention, job-cascade delete, manual delete, and crash-recovery resume
all clean up local copies alongside remote ones.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -54,6 +54,7 @@ Important runtime settings live in SQLite, not files:
 - remote path inside that rclone remote
 - timezone
 - retention defaults
+- keep local backups after upload (global toggle)
 - Discord webhook URL
 - CORS origins
 
@@ -102,6 +103,7 @@ Expected states:
 - `completed`
 - `failed`
 - `deleting`
+- `local_downloading`
 - `deleted`
 
 Important behavior:
@@ -115,10 +117,14 @@ Important behavior:
 <rclone_remote>:<rclone_remote_path>/<backup_id>/<archive_name>
 ```
 
+- `local_deleting` only unlinks the local archive when the `keep_local_backups` setting is off (the default). When it's on, the archive stays in `local_backup_dir` after `completed` and `local_path` stays populated.
+- Deleting a backup (manual delete, job-cascade delete, retention, or crash-recovery resume of a `deleting` backup) always removes both the remote object and any locally-retained archive, regardless of `keep_local_backups` — that setting only affects the immediate post-upload step, not deletion.
 - Deleting a backup removes the exact remote file and then attempts to remove the empty `<backup_id>` folder.
 - Deleting a backup already in `deleted` state purges the SQLite metadata row.
 - Deleting a job deletes all known non-active backups for that job first, then removes the job.
 - Retention runs after backup completion and hourly from the worker.
+- A completed backup whose local archive is missing (never kept, or deleted via "Delete local copy") can be re-fetched from the remote into `local_backup_dir` via `POST /api/backups/{id}/download`; this is a transient `local_downloading` state that resumes on worker restart. Since `local_backup_dir` is the actual Proxmox storage dump directory, a downloaded archive shows up in the Proxmox UI for the operator to restore from directly — this app never runs the restore itself.
+- A locally-retained (or downloaded) copy can be removed independently of the remote object via `DELETE /api/backups/{id}/local`, without affecting `state` or `remote_path`.
 
 ## Applying updates after pulling changes