feat(cmd): add backup command

[ishaan-jindal]

Would close #45

[jochumdev]

Nice work, thank you.

See the comments and please make sure that you inline every helper that is used only once or even twice.

[jochumdev]

Solid work! Thanks for resolving everything.

Next thing is progress, I don't think we get the percentage from incus but we can a show a spinner per volume.

I would like to add some more changes, we can squash those after, ok?

[ishaan-jindal]

Sure Squash at the end works.
Heads up: I'm adding a few more lock tests first

[ishaan-jindal]

relock interval every 30 seconds
Since, refresh = stale (both 60s) is zero margin

[jochumdev]

Last commit looks damn great! Had no detailed look at it yet as I'm working on a healthd rewrite, will check later.

[ishaan-jindal]

@jochumdev I am hitting a latent DNS watcher race: two processes with watchers on the same network (e.g. concurrent stop/up, or two backup create) PATCH the network simultaneously and trip server-side idempotency races — Failed to add address ... already assigned and Failed clearing firewall ... chain not found. The ETag retry (client_dnswatcher.go:186) doesn't cover these; the end state is correct either way.

Full disclosure: I ran this through an AI to trace the root cause, and this is the output I got — my parallel backup test hits it.

Would you treat those two errors as benign (or retry) in the watcher?

[jochumdev]

Nice bug you found. I was never a friend of retry but recently I became friends with it, so go retry.

It's ok to have that bugfix in this branch :)

And about DNS in general, soon we will have CoreDNS with AXFR from incus network zones and ECS on top.
Means no more dnsmasq.

[jochumdev]

Done on the update.

Integrated your logic as an "Action", using one file per run.