Archive the whole data volume in Backups, not just the database

Settings > Backups gains a whole-data archive beside the database
snapshots, and both lists now fully work from the page.

- Data archives: `write-data-backup-archive.ts` tars all of DATA_DIR into
  BACKUP_ARCHIVE_DIR as cobble-data-<epoch-ms>.tar.gz, every entry under one
  root folder named after the archive, writing a .part name and renaming on
  success so a cut-off run is never listed. The newest
  AppData.DataBackupsKept are kept; db/.backups is left as it is.
- Restore: `restore-data-backup.ts` extracts to a temp dir, requires one
  root folder holding a db folder, takes a safety archive first, then
  replaces DATA_DIR (the database snapshots included) and `restart-app.ts`
  restarts the process through the docker socket, since the open SQLite
  handle points at the replaced file.
- Upload and restore: a modal over each list (database file or data
  archive), replacing the old /admin/settings/backups/restore page.
- Delete for both kinds, icon-only row actions shared through
  RowIconButton, and restore on every row.
- One backup or restore of either kind at a time (with-backup-run-lock).
- BACKUP_ARCHIVE_DIR is a start-up path (ProcessOnlyEnvKeys); the installer
  mounts $COBBLE_HOME/backups-archives at /backups-archives and recreates a
  container that lacks it. The image installs tar and gzip.

src/functions/backend/backups/with-backup-run-lock.ts

@@ -0,0 +1,25 @@
+let is_running = false;
+
+type Params<T> = {
+    task: () => Promise<T>;
+};
+
+/**
+ * Runs one backup or restore at a time, whichever kind it is, so a
+ * database snapshot, a database restore and a whole-data archive never
+ * overlap and never fight over the same files. Hands back what the task
+ * returned.
+ */
+export default async function withBackupRunLock<T>({ task }: Params<T>) {
+    if (is_running) {
+        throw new Error(`Another backup or restore is already running`);
+    }
+
+    is_running = true;
+
+    try {
+        return await task();
+    } finally {
+        is_running = false;
+    }
+}