Back up a running instance without stopping it

[sinhaparth5]

The only correct backup procedure was "stop the server, copy the data directory, start it again". Copying it live races the metadata against the payload tree and produces a store whose rows name payloads the copy does not contain, which --fsck correctly calls corrupt. For a single binary with no sidecars, "you cannot back it up without downtime" is the gap most likely to stop somebody putting real data behind it.

Adds monobucket --checkpoint

and a console action under Settings -> Backup. The metadata goes through RocksDB's checkpoint API and the payload tree is hard-linked, so on one filesystem a backup duplicates no bytes and returns in about the time it takes to flush the write-ahead log. Restore is: stop, point MONOBUCKET_DATA_DIR at the checkpoint, start — a checkpoint is a data directory, so there is no import step.

Snapshot-then-link is only half the guarantee. deleteObject unlinks its payload immediately, so a delete landing between the two passes would strip a payload the snapshot still names. StorageEngine::checkpointing_ makes reclamation a no-op for the duration; nothing leaks, because deleteObject writes the orphan record in the same batch that removes the row, so the next pass collects what the window skipped. checkpoint_test.cpp asserts this against a concurrent deleter and fails without the barrier.

The CLI form needs a stopped server — one process may open the metadata store at a time — so backing up a running instance is the console's job, because the running process is the only thing that can copy its own store. That endpoint is off until MONOBUCKET_BACKUP_DIR names somewhere it may write, and backups are created inside it under a name that may not contain a separator: the destination arrives over HTTP, and a console session is not a shell on the host. It is gated on a new Permission::BackupWrite rather than settings:write, because a checkpoint copies every S3 secret in the instance.

Nothing is scheduled. A copy is written when somebody asks and never on a timer; retention and off-site copies belong to a backup tool.