Add Backup & Restore page with Google Drive integration

[Copilot]

Users had no way to back up their account data (devices, device groups). This adds a /backup page enabling local JSON backup/restore and cloud storage via Google Drive OAuth.

Core changes

• Shared/Dtos/BackupData.cs — DTO models (BackupData, DeviceBackupDto, DeviceGroupBackupDto) for serializing user account data
• Server/Services/BackupService.cs — IBackupService for creating, serializing, deserializing, and restoring backups. Restore only updates device metadata (alias, tags, notes, group) for devices that still exist in the org
• Server/Services/GoogleDriveService.cs — IGoogleDriveService wrapping Google Drive v3 API: OAuth flow, upload/list/download to a Remotely Backups folder
• Server/API/GoogleDriveCallbackController.cs — OAuth callback endpoint with cryptographic state token validation
• Server/Components/Pages/Backup.razor — Full page UI: download backup, upload restore file, connect Google Drive, list/restore cloud backups
• Server/Components/Layout/NavMenu.razor — Added "Backup" nav link for authenticated users

Security

• CSRF: one-time cryptographic state tokens for OAuth callback validation
• Open redirect: LocalRedirect("/backup") instead of Redirect
• Ownership: backup userName verified against current user before restore
• Size limits: 10MB cap on both local file upload and Google Drive downloads
• Async: RestoreBackupAsync avoids .Wait() deadlocks

Configuration

Google Drive is optional. Server admins add credentials to appsettings.json:

"GoogleDrive": {
  "ClientId": "",
  "ClientSecret": ""
}

When unconfigured, the UI shows an informational message instead of the connect button.

Tests

9 new tests in BackupServiceTests.cs covering creation, round-trip serialization, restore behavior, and edge cases. All 27 tests (18 existing + 9 new) pass.

---

Please read the following. Do not delete below this line.

Thank you for your contribution to the Remotely project. It is required that contributors assign copyright to Immense Networks so we retain full ownership of the project.

This makes it easier for other entities to use the software because they only have to deal with one copyright holder. It also gives me assurance that we'll be able to make decisions in the future without gathering and consulting all contributors.

While this may seem odd, many open source maintainers practice this. Here are a couple well-known examples:

• Free Software Foundation: http://www.gnu.org/licenses/why-assign.html
• Microsoft: https://cla.opensource.microsoft.com/

A nice article on the topic can be found here: https://haacked.com/archive/2006/01/26/WhoOwnstheCopyrightforAnOpenSourceProject.aspx/

By submitting this PR, you agree to the following:

You hereby assign copyright in this PR's code to the Remotely project and its copyright holder, Immense Networks, to be licensed under the same terms as the rest of the code. You agree to relinquish any and all copyright interest in the software, to the detriment of your heirs and successors.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.cdnjs.com
  • Triggering command: /usr/bin/dotnet dotnet build Server/Server.csproj ely uppo�� (dns block)
  • Triggering command: /usr/bin/dotnet dotnet build Server/Server.csproj /p:ResolveLibManAssets=false ptsP�� (dns block)
  • Triggering command: /usr/bin/dotnet dotnet build Server/Server.csproj /p:LibManRestore=false /p:DisableLibManRestore=true --no-restore (dns block)
• unpkg.com
  • Triggering command: /usr/bin/dotnet dotnet build Server/Server.csproj ely uppo�� (dns block)
  • Triggering command: /usr/bin/dotnet dotnet build Server/Server.csproj /p:ResolveLibManAssets=false ptsP�� (dns block)
  • Triggering command: /usr/bin/dotnet dotnet build Server/Server.csproj /p:LibManRestore=false /p:DisableLibManRestore=true --no-restore (dns block)
• www.myget.org
  • Triggering command: /opt/hostedtoolcache/CodeQL/2.24.2/x64/codeql/csharp/tools/linux64/Semmle.Autobuild.CSharp /opt/hostedtoolcache/CodeQL/2.24.2/x64/codeql/csharp/tools/linux64/Semmle.Autobuild.CSharp (dns block)
  • Triggering command: /usr/bin/dotnet dotnet restore --no-dependencies /home/REDACTED/work/Remotely/Remotely/Remotely.sln --packages /tmp/codeql-scratch-308cdbf2ab4d8643/dbs/csharp/working/packages /p:DisableImplicitNuGetFallbackFolder=true --verbosity normal /p:TargetFrameworkRootPath=/tmp/codeql-scratch-308cdbf2ab4d8643/dbs/csharp/working/emptyFakeDotnetRoot /p:NetCoreTargetingPackRoot=/tmp/codeql-scratch-308cdbf2ab4d8643/dbs/csharp/working/emptyFakeDotnetRoot /p:AllowMissingPrunePackageData=true /hom�� (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.