Rewrite the backup command on the library API with a durable failure ledger (closes #51)

Rewrites backup on the library API. backup() refreshes, fetches pending originals (and optionally thumbnails) through the pools reusing the content cache, then materialises the unchanged collections/ symlink views + per-collection JSON + sidecars from the model. A symlink failure no longer aborts the run (closes #8). failures.json reconciles against each run's attempted set — since-deleted/out-of-scope/resolved entries clear, still-failing retained, one attempt per file per run — and the exit-code contract is preserved.

Model: opus-4-8

src/index.ts

@@ -59,6 +59,10 @@ export {
     type EnsureOptions,
     type EnsureResult,
     type EnsureEvent,
+    runBackup,
+    type BackupOptions,
+    type BackupResult,
+    type BackupError,
 } from "./library/index.js";
 export {
     RequestPools,