Feature Request: One-Click Full Instance Backup & Restore (All Teams)

**Motivation**

Self-hosted Buzz operators running multiple teams currently must manually back up 5+ separate infrastructure components (PostgreSQL, S3/MinIO, Git volumes, relay private key, agent secrets, .env, docker-compose.yml) to fully restore their entire Buzz instance. There's no app-level "export everything" or "restore from backup" feature.

This creates critical problems for multi-team operators:

- No single backup file — must orchestrate 5+ separate backups manually
- High risk of incomplete backups (e.g., forgetting a Git volume or agent secret)
- No point-in-time consistency across components (database captured at 2:00 AM, S3 at 2:15 AM)
- No disaster-recovery testing path for non-expert operators
- Massive friction when migrating servers or recovering from failures
- Multi-team operators cannot backup all their teams in one action — must script across all teams manually
- Who runs into it: Self-hosted Buzz admins (especially solo operators or small teams with multiple teams/communities) during server migrations, VPS failures, or before major upgrades.

Who runs into it: Self-hosted Buzz admins (especially solo operators or small teams with multiple teams/communities) during server migrations, VPS failures, or before major upgrades.

**Proposed solution**

Add a Settings → Backup & Restore panel with:

1. Full Instance Export (one button, captures EVERYTHING)
- Creates a single encrypted .tar.zst archive containing:
- PostgreSQL dump (complete: all teams, channels, messages, agents, users, plugins, workflows, integrations, permissions, custom commands)
- S3/MinIO bucket (complete: all files, images, attachments, generated media, cached content)
- Git repository volumes (complete: all bare repos, pack caches, worktrees)
- .env file (complete: all env vars, API keys, secrets, MCP configs, custom endpoints, OAuth tokens)
- docker-compose.yml (complete: all services, networks, volumes, port mappings, health checks)
- All plugin directories (code, configs, data, state for every installed plugin)
- All MCP server directories (code, configs, auth for every MCP server)
- All agent identity files (private keys, personas, prompts, tool permissions, memory)
- All TLS certificates and proxy configs (Traefik, Caddy, etc.)
- All monitoring/alerting configs
- Metadata JSON (Buzz version, commit SHA, all component versions, team count, plugin inventory with versions, harness mappings)
- Archive is encrypted with user-provided passphrase
- Downloaded to local machine or uploaded to configured remote storage
- One file = entire Buzz instance, all teams, literally everything

2. Full Instance Restore (one button, restores ALL teams)
- Upload .tar.zst archive
- Validate checksum and decrypt
- Stop Buzz services
- Restore PostgreSQL (all communities), S3 (all files), Git volumes (all repos), .env, and Compose file
- Verify integrity (run health checks, validate relay key, test all agent identities across all teams)
- Restart services
- One restore = entire Buzz instance, all teams back online

3. Automated Scheduled Backups (optional)
- Cron-based daily/weekly backups of entire instance
- Retention policy (e.g., keep last 7 daily, 4 weekly)
- Remote storage destination (S3, Backblaze, local path)
- Success/failure notifications (email, webhook, Buzz DM)

4. Backup Verification
- "Test restore" button that spins up a temporary Docker container and validates the archive can be restored without affecting production

**Alternatives considered**

Manual scripting (current workaround): Operators write custom docker compose exec + pg_dump + tar scripts. Fragile, error-prone, no UI feedback, no encryption by default, must manually ensure all teams' data is captured.

Per-team export: Would require separate backups for each team — unacceptable UX.

Infrastructure-level snapshots (VPS provider backups): Captures entire disk, but not portable across providers, no point-in-time consistency for Buzz components, includes unrelated system files.

buzz-archive plugin (#4915): Community archiver for room history, but doesn't cover full instance (no Git, no S3, no .env, no agent secrets, single-team only).

Tenant-scoped export (#6171): Discusses "coherent, tenant-scoped export" but no implementation yet, and would require separate exports for each team.

**Additional context**

Existing related issues:
- #6171: "tenant-scoped export and self-hosted migration procedure" (open, asks for coherent export — but tenant-scoped, not full-instance)
- #4915: "buzz-archive — own your room history" (community plugin, partial solution, single-team only)
- #5731: Referenced in #7376 as "Whole-workspace export/restore" (disaster-recovery tool — unclear if multi-team)
- #2618: "Evaluate RustFS as the default Apache-2.0 S3 backend" mentions "backup/restore tooling"

Buzz docs explicitly warn operators to back up 5+ components manually but provide no tooling to automate or verify this.

Multi-team operators cannot reasonably perform separate backups — need one button for entire instance.

None found (closest is #6171, but this is a superset request for full-instance backup across all teams, not per-team export)