Design cloud backup and restore UX

Context

Future work from docs/superpowers/specs/2026-05-24-local-libsql-migration-design.md.

The local libsql migration is a prerequisite. This issue should be designed after the cloud configuration model is settled, because backup UX depends on storage mode and credential ownership.

Scope

• Define user-facing backup and restore commands or bot flows.
• Decide how local data.db, Turso databases, and existing restore behavior interact.
• Preserve rebuildable-excludes and no-secrets-in-context constraints.
• Define failure and rollback behavior for partial restores.

Acceptance Criteria

• Backup and restore flows are explicit about local-only, cloud-backed, and mixed states.
• Restore never requires deleting sandboxes or recreating agents.
• Credential handling stays outside agent sandboxes.
• Documentation explains operator-visible recovery behavior.

Out Of Scope

• Implementing embedded replica sync.
• Doctor health checks for sync lag.
• Low-level libsql driver migration.

Start by reading docs/superpowers/specs/2026-05-24-local-libsql-migration-design.md and confirming the cloud configuration model it depends on. Define the user-facing backup and restore flows for local-only, cloud-backed, and mixed states, including partial-restore failure behavior and credential boundaries. Done means the design covers the acceptance criteria and documents operator-visible recovery behavior without implementing libsql sync.