Add stock configuration backup and restore

[MarcLeinenDE]

Adds binary /file.cgi transport support and production-facing configuration backup/restore helpers based on the source-verified ACIY.3 stock WebUI contract.

Implemented:

• HTTPTransport.file_download() for authenticated opaque binary GETs
• HTTPTransport.file_upload() for raw octet-stream POSTs
• maintenance.download_config_backup() -> GET /file.cgi?Action=Download&file=backup_config&dl=1
• maintenance.restore_config_backup() -> sequential raw POST /file.cgi?Action=Upload&file=restore_config
• stock 1 MiB default chunking
• stock 200 MiB selected-file limit
• no multipart/form-data, filename field, JSON, or Content-Range
• other error response rejection
• final-chunk transport loss treated as inconclusive
• success requires management recovery plus a real boot_time reset
• backup bytes are never copied into SDK diagnostics

Physical result on 2026-09-21: PASS.

Observed same-device backup/restore lifecycle:

• initial backup: 14,424 bytes, SHA-256 ec87316928c9a3cb033ce2f2b3024bfdfd1c2c3efef43c94df8990549c1ea26e
• restore upload: 14,424 bytes, one chunk
• management outage observed; final upload surfaced TransportError
• boot_time 434 -> 55 proved full reboot
• UPnP API needed four additional readiness retries after runtime recovery; joint config snapshot succeeded on attempt 5
• stable configuration snapshot matched exactly before/after restore
• post-restore backup: 14,432 bytes with a different SHA-256, proving backup bytes are not stable identity for equivalent restored configuration
• backup download remained functional after recovery

Therefore restore verification is state-based, not backup-byte/hash equality based.

Upstream file-CGI source contract and post-restore readiness evidence are merged.
Offline CI #358: SUCCESS (Python 3.10–3.13 + packaging).

USB mode remains untouched and deferred to the final campaign stage.