feat(backups): filter, preview, compare and bulk delete (v0.24.2-beta)

Closes #134.

Backups are `/export compact` output — plain RouterOS script, not the binary
`.backup` blob — which is what makes the reporter's "it's just a text, after
all" correct and most of this cheap.

  - Filters: device, type, date range and free text over device name,
    filename and notes. Dates are inclusive at both ends, because a picker
    showing "to: 3 Sep" that stops at that day's first instant is a trap.
  - Preview in place, on row click. No round trip through the downloads
    folder to see what a backup contains.
  - Compare any two, reusing the lineDiff that Config History already uses
    rather than adding a second diff implementation.
  - Bulk delete, with selection and a confirmation that names what goes.

Two deliberate choices.

Bulk delete had to respect an existing invariant: a backup and its config
snapshot are one artifact, joined by ON DELETE CASCADE so they cannot drift
apart. Removing fifty in one click can therefore destroy restore points
nobody looked at. The confirmation is built from a server-side preview that
reports the backups per device *and* how many config snapshots will go with
them, and it is capped at 200 per call. The action is also site-scoped, so it
cannot reach into another site's history.

The Filename column is gone from the table but the filename is not gone: it
is the natural handle for a file — device and timestamp, the thing you would
quote to a colleague — so it moved to the preview and diff headers where you
are actually looking at that file, rather than being dropped.

Diff direction is extracted and tested. Selection order in a table is
whatever the user happened to click and carries no meaning, so the pair is
ordered oldest-first; rendered the other way round every addition reads as a
deletion, and nothing about the output looks wrong while it does.

Incidentally fixed: 'pre-upgrade' backups were labelled "Manual" in the table
because the badge only knew three types. Type wording now has one home.

The list query's placeholder counter is replaced by a bind() helper deriving
from params.length. The counter's final increment was dead, and whoever added
the next filter would have inherited a stale index.

Verified against 110 real backups: every filter and combination returns the
expected counts and partitions cleanly, preview and diff read real .rsc with
file_path withheld, and bulk delete removed three throwaway backups plus
their files and left the other 110 untouched. Guards checked: empty, missing,
non-numeric and injected ids, unknown ids, and the 200 cap.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/version-0.24.1_Beta-blue" alt="Version" />
+  <img src="https://img.shields.io/badge/version-0.24.2_Beta-blue" alt="Version" />
   <img src="https://img.shields.io/badge/license-AGPLv3-blue" alt="License" />
   <img src="https://img.shields.io/badge/docker-compose-2496ED?logo=docker&logoColor=white" alt="Docker" />
   <img src="https://img.shields.io/badge/TypeScript-5.3-3178C6?logo=typescript&logoColor=white" alt="TypeScript" />
@@ -340,7 +340,7 @@ Each network service supports multi-device management with conflict detection:
 ### Fleet operations
 
 - **Firmware orchestration** — fleet version overview, live update checks, and MikroTik's official release notes in-app. Staged rollouts run in **waves** (wave 1 = canary) through a verified pipeline per device: pre-upgrade backup → install → ride out the reboot → confirm it returned healthy on the new version → next. **Halt on failure** stops the rollout if any device fails, and a device that comes back on the *old* version counts as a failure. Rollouts can be scheduled, and cancelling never interrupts an in-flight flash
-- **Backups** — on demand or on a daily/weekly/monthly schedule for all online devices, downloadable from the UI. Config snapshots and their restorable `.rsc` are one artifact: delete either and both go, so they never drift apart
+- **Backups** — on demand or on a daily/weekly/monthly schedule for all online devices. Filter by device, type and date range; read one in place instead of downloading it; and compare any two as a diff — they are `/export` text, not opaque blobs. Config snapshots and their restorable `.rsc` are one artifact: delete either and both go, so they never drift apart, and a bulk delete says how many snapshots it will take with it
 - **Configuration templates** — reusable sets (DNS, NTP, syslog) pushed to many devices with per-device result reporting
 - **Bulk device add** — "Try All" on discovered devices runs as a server-side job that survives a closed browser tab, with live progress and cancel
 - **Device organisation** — colour-coded tags, rack location, physical address with map support, and per-device notes