feat: export encrypted DockerVault recovery bundle and restore during setup

[Serph91P]

Motivation

After rebuilding DockerVault, an operator should restore settings and immediately manage existing backups without recreating targets, schedules, retention, storage, and catalog state manually.

Required behavior

• downloadable password-protected .dockervault bundle
• include portable configuration, catalog, and encrypted credentials
• exclude backup archives, transient state, logs, sessions, environment dumps, and private SSH keys
• Argon2id password derivation and authenticated encryption
• first-run choice between new setup and restore
• isolated validation, atomic activation, and rollback
• storage connection tests and non-destructive catalog reconciliation

Acceptance

See Phase 3 in docs/plans/2026-07-11-storage-recovery-komodo-implementation.md and the approved design in PR #140.