Fail closed across backup lifecycle and remote sync failures

[Serph91P]

Problem

Backup lifecycle failures can currently produce unsafe or misleading outcomes across remote sync, cancellation, and hook execution.

The existing safety branch already addresses several related failure paths, but independent review found three remaining P1 gaps:

1. A configured remote storage can be missing from the backend result map. Local deletion is prevented, but the missing result is not persisted as failed and progress can incorrectly report a successful zero-failure sync.
2. Archive creation and restore extraction run in executor threads. Cancelling the coroutine can restart stopped containers while the worker thread is still reading or writing backup data.
3. Hook command arguments and hook stdout or stderr are logged verbatim. These values can contain credentials or other secrets.

Required behavior

• Treat every configured remote storage without an explicit successful result as failed.
• Persist a failed BackupStorageSync row for each missing result and report accurate success and failure counts.
• Never delete local archive or key material unless every required archive and key upload explicitly succeeds.
• On cancellation, wait for active archive or extraction executor work to finish before restarting containers, then propagate CancelledError.
• Keep container restart cleanup bounded and cancellation safe.
• Never log hook arguments, stdout, or stderr. Logging the validated executable name and generic exit status is sufficient.
• Preserve existing successful backup, restore, encryption, and remote sync behavior.

Verification

• Add regression tests that fail on the current branch for all three findings.
• Run the focused backup engine tests and the complete backend test suite.
• Run Ruff check and format verification.
• Run git diff --check, secret scanning, and the repository Unicode dash check.
• Complete an independent read-only review before merge.