Add local backup retention: keep-local toggle, download, delete-local

Lets operators opt into keeping the local archive after upload (global
keep_local_backups setting), pull a remote archive back down into the
Proxmox dump directory for manual restore, and drop a locally-retained
copy without touching the remote object. Consolidates deletion so
retention, job-cascade delete, manual delete, and crash-recovery resume
all clean up local copies alongside remote ones.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/migrations.py

@@ -46,6 +46,7 @@ DEFAULT_SETTINGS = {
     "default_retention_value": "30",
     "max_concurrent_backups": "1",
     "timezone": _system_timezone(),
+    "keep_local_backups": "false",
 }
 
 
@@ -186,3 +187,17 @@ def run_migrations() -> None:
                 "INSERT INTO schema_migrations(version, applied_at) VALUES (?, ?)",
                 (5, now),
             )
+        if 6 not in applied:
+            now = utc_now()
+            conn.execute(
+                """
+                INSERT INTO settings(key, value, updated_at)
+                VALUES ('keep_local_backups', 'false', ?)
+                ON CONFLICT(key) DO NOTHING
+                """,
+                (now,),
+            )
+            conn.execute(
+                "INSERT INTO schema_migrations(version, applied_at) VALUES (?, ?)",
+                (6, now),
+            )