Whole-cluster backups + on-demand backup/restore endpoints

Switch default tunnel to bore (no token needed)

Deploy: postgres + ngrok tunnel + gradio watcher + backups