Advanced administration parity: backups, S3, federated credentials, and API keys

[mkaltner]

Scope

Track advanced administration workflows intentionally deferred from the initial Android parity/handoff milestone:

• system backup history, creation/discovery, recovery keys, browse/restore, upload, delete, and policies;
• S3 destination CRUD and connection testing;
• federated credential CRUD with role/environment mappings;
• API-key detail, expiry, permission scopes, edit, safe rotation, and protected-key behavior.

Requirements

• Revalidate current iOS, Arcane, libarcane-swift, and Android before implementation.
• Add typed libarcane-kotlin contracts before Android UI; do not duplicate REST or DTOs in the app.
• Gate all destinations and actions using server capabilities, permissions, and access surfaces.
• Protect one-time credentials and recovery material from persistence, logs, screenshots, and backups.
• Use resource/environment-specific confirmation and durable operation handoff where appropriate.
• Cover old/unsupported servers, restricted users, partial failures, cancellation, and process recreation.
• Validate on an AVD against disposable Arcane instances; never use production data.

This is deferred roadmap work, not a blocker for the current Android handoff milestone.

[mkaltner]

Cross-link: #66 establishes server access-surface gating and contract-correct core System Settings, but does not add backup/S3/federated-credential/API-key administration breadth. Those workflows and their security/runtime acceptance criteria remain deferred here.