Add backup/restore, daily auto-backup and history CSV/JSON export (Phase E3)

- create_backup writes a zip (manifest with sha256 per file, a VACUUM INTO database snapshot, assets, archive, fonts) atomically. restore_backup validates the manifest, rejects tampered files, path traversal, symlinks and newer schemas, checks the staged DB with integrity_check, then stages a pending restore. The swap runs on the next start before the database opens, moves the current data to backups/pre-restore-<ts>/ and rolls back on any failure.
- Daily automatic backup (migration M9 auto_backup, default on) keeps the newest 14 and never blocks startup.
- Settings Data tab: back up now, restore with confirmation and restart, auto-backup toggle, last backup time.
- History exports the filtered rows as CSV (UTF-8 BOM, CRLF, formula-injection guard) or JSON (voiced.history.v1) with CA-friendly tax columns from a new list_invoice_ledger command.
- Rust round-trip, rejection, swap-rollback and retention tests; vitest for the export and backup helpers.

Adds the zip 8.6.0 and typed-path 0.12.3 crates (pure Rust); package builds must vendor them. PDF output and fingerprint goldens are unchanged. The new UI has not been run in a webview yet.

src-tauri/src/db.rs

@@ -10,7 +10,7 @@ const MAX_BACKUPS: usize = 10;
 const BACKUP_PREFIX: &str = "voiced-pre-v";
 
 /// Highest schema version, i.e. the number of entries in `migrations()`.
-const LATEST_VERSION: i64 = 8;
+pub(crate) const LATEST_VERSION: i64 = 9;
 
 #[derive(Debug, thiserror::Error)]
 pub enum DbError {
@@ -264,6 +264,12 @@ CREATE TABLE payments (
 CREATE INDEX idx_payments_invoice ON payments(invoice_id);
 "#;
 
+/// Version 9: `auto_backup` switches the daily automatic backup (see commands::backup). On by default. It is read and
+/// written through its own commands, not through `Settings`, so a settings save can never clobber it.
+const M9: &str = r#"
+ALTER TABLE app_settings ADD COLUMN auto_backup INTEGER NOT NULL DEFAULT 1;
+"#;
+
 fn migrations() -> Migrations<'static> {
     Migrations::new(vec![
         M::up(SCHEMA),
@@ -274,6 +280,7 @@ fn migrations() -> Migrations<'static> {
         M::up(M6),
         M::up(M7),
         M::up(M8),
+        M::up(M9),
     ])
 }
 
@@ -294,7 +301,14 @@ pub fn open(path: &Path, backup_dir: &Path) -> Result<Connection, DbError> {
     Ok(conn)
 }
 
-fn has_user_tables(conn: &Connection) -> rusqlite::Result<bool> {
+/// Write a consistent, compacted snapshot of the open database to `target` (which must not exist yet).
+/// Safe while other connections read and write: SQLite takes a read transaction for the copy.
+pub(crate) fn vacuum_into(conn: &Connection, target: &Path) -> rusqlite::Result<()> {
+    let quoted = target.to_string_lossy().replace('\'', "''");
+    conn.execute_batch(&format!("VACUUM INTO '{quoted}'"))
+}
+
+pub(crate) fn has_user_tables(conn: &Connection) -> rusqlite::Result<bool> {
     conn.query_row(
         "SELECT EXISTS (SELECT 1 FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%')",
         [],
@@ -312,8 +326,7 @@ fn backup_before_migration(
     fs::create_dir_all(backup_dir)?;
     let stamp = chrono::Local::now().format("%Y%m%d-%H%M%S");
     let target = backup_dir.join(format!("{BACKUP_PREFIX}{version}-{stamp}.db"));
-    let quoted = target.to_string_lossy().replace('\'', "''");
-    conn.execute_batch(&format!("VACUUM INTO '{quoted}'"))?;
+    vacuum_into(conn, &target)?;
     // A failed prune must not block startup; the backup itself already succeeded.
     let _ = prune_backups(backup_dir, MAX_BACKUPS);
     Ok(target)