Google Auto Backup of the age-encrypted blob, passphrase-gated restore

Per request: re-enable allowBackup but scope it to ONE file via
include-rules — files/gbackup/latest.json.age, an age-encrypted export
written only while a backup passphrase is set (never plaintext to
Google; DB/prefs stay excluded). On a new device the OS restores the
blob, the Today screen detects an empty DB + present blob and offers
'Gjenopprett' — which demands the passphrase typed, since the Keystore
key never migrates. Clearing the passphrase deletes the blob.

scrypt work factor dropped 18→15: age's desktop default needs a 256 MiB
working set and OOM-crashed on-device (found the hard way); 15 = 32 MiB,
still real brute-force cost, and largeHeap covers decrypting foreign
files made at 18. Verified by instrumented round-trip tests (write →
empty DB → restore; wrong passphrase keeps DB empty; cleared passphrase
removes blob) — UI automation couldn't drive the multi-field dialog
reliably, so the proof lives in the test instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CLAUDE.md

@@ -31,7 +31,10 @@ The name says the brief: nag me to take the dose *now*.
 3. Re-arm every alarm on `BOOT_COMPLETED` + `MY_PACKAGE_REPLACED` (state is wiped then).
 4. Surface a one-time battery-optimisation exemption prompt — biggest cause of dropped
    reminders on aggressive OEMs.
-5. No Google Auto Backup (`allowBackup="false"`, excluded from cloud-backup + transfer).
+5. Google Auto Backup carries ONLY the app's own age-encrypted blob (`files/gbackup/`,
+   include-rules in dataExtractionRules/fullBackupContent exclude everything else).
+   Blob exists only while a passphrase is set; restore on a new device requires typing
+   it (Keystore never migrates). Amended 2026-06 from a full opt-out, on user request.
 6. Own backup: versioned JSON → encrypted → S3-compatible PUT to self-hosted **Garage**,
    path-style, hand-rolled SigV4. One serializer for export, import, and auto-backup.
 7. Crypto target is **age** (passphrase/scrypt) so backups are `age -d`-decryptable and