feat(backup): write database dumps gzip-compressed

Dumps stream through gzip into <db>.backup.sql.gz; no uncompressed copy touches the disk. Restore reads gzip and plain dumps by their magic bytes, verifies a gzip dump to its end before anything is dropped, and still finds the uncompressed names of older generations. The manifest names the compression.

🎯 Fix: 92 %
💥 Break: 20 %
💸 Cost: –
⏱️ Time: –
🛡️ Security: ~100 %
🏆 Score: 74
🚦 Gate: ⛔ break 20 % > 5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/backup/test_docker_exec_env.py

@@ -44,12 +44,12 @@ class TestPostgresDumpCarriesThePassword(unittest.TestCase):
 
         import baudolo.backup.db as db
 
-        original = db.execute_to_file
-        db.execute_to_file = fake
+        original = db.execute_to_gzip
+        db.execute_to_gzip = fake
         try:
             fallback_pg_dumpall("pg", "user", "secret", "/tmp/out.sql")
         finally:
-            db.execute_to_file = original
+            db.execute_to_gzip = original
 
         self.assertIn("-e", seen["command"])
         self.assertEqual(seen["command"][seen["command"].index("-e") + 1], "PGPASSWORD")