Add backup encryption key rotation support

[Mystery-CLI]

🔧 Title: Add backup encryption key rotation support

📘 Description
backend/src/backup/manager.js encrypts backups with BACKUP_ENC_KEY. There is no mechanism to rotate this key, meaning a compromised key exposes all historical backups.

✅ Acceptance Criteria

• Add POST /api/backup/rotate-key endpoint (admin only)
• Re-encrypt all existing backups with the new key
• Store key version alongside each backup
• Add BACKUP_ENC_KEY_PREVIOUS env var for decrypting old backups during rotation
• Add tests for key rotation

🔧 Context: backend/src/backup/manager.js; backend/src/routes/backup.js.

---