feat: manueller Backup-Button für Admin

POST /api/backup (nur Admin) löst triggerBackup() aus.
Button im Header zeigt ⏳/✓/✗ Feedback, verschwindet nach 4s.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/backup/route.ts

@@ -0,0 +1,12 @@
+import { NextResponse } from 'next/server';
+import { getSession } from '@/lib/session';
+import { triggerBackup } from '@/lib/backup';
+
+export async function POST() {
+  const session = await getSession();
+  if (!session) return NextResponse.json({ error: 'Nicht angemeldet' }, { status: 401 });
+  if (!session.role?.includes('admin')) return NextResponse.json({ error: 'Keine Berechtigung' }, { status: 403 });
+
+  triggerBackup();
+  return NextResponse.json({ ok: true });
+}