fix(backup): keep GUI backup paths under BACKUP_ROOT and limit the schedule

backup:configure could point automatic backups at any writable directory
(e.g. a statically served one) and set a cron of every second; an invalid
expression deleted the running job before failing, silently ending
backups.

- A path entered in the UI is resolved under BACKUP_ROOT (default
  ./backups) and refused if it leaves it; env values stay unrestricted.
- The schedule must be a five-field cron that runs at most hourly.
- reload() validates before replacing the running job.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/.env.example

@@ -33,6 +33,9 @@ DOCUMENTS_STORAGE_PATH="./uploads"
 # ihre eigenen Backup-Dateien und die Lauf-Erkennung zwischen Replicas greift
 # nicht.
 BACKUP_STORAGE_PATH="./backups"
+# Directory a backup path set in the admin UI must stay under (the env
+# variable above is not restricted). Default "./backups".
+# BACKUP_ROOT="./backups"
 # Cron-Ausdruck (Standard: taeglich um 03:00 Uhr).
 BACKUP_CRON_SCHEDULE="0 3 * * *"
 # Wie viele der neuesten Backup-Dateien behalten werden, aeltere werden nach