Restructure the backup IA around a single Backups hub

[bradleymackey]

Summary

The backup surface was split across two sidebar peers ("Backup" and "Restore"), with the Backup screen stacking four unrelated jobs — password management, inline auto-backup settings, PDF export, and device transfer — into one form. The password screen's "Generate Key" action also read as password generation when it actually derives an encryption key from a typed password. This PR restructures the IA:

• Single "Backups" sidebar item opening a hub: a last-backup status banner (revives the orphaned LastBackupSummaryView) plus rows for Auto-Backup, Export, Restore, and Backup Password. BackupCreateView becomes BackupExportView (PDF + device transfer only); its strings-only view model and nine orphaned xcstrings keys are deleted.
• Backup password screen reframed: the action is "Set Backup Password" (revealed alongside the entry fields once a password is typed), key derivation is presented as a progress state with distinct cancelled/error copy, and the About text explains derivation without the "generate" framing. Keygen cancellation and plaintext clearing are untouched.
• Auto-Backup gets its own screen backed by a new AutoBackupViewModel (the initial-state-injection refactor deferred in Snapshot the rebuilt backup and encryption-edit screens #573): state is seeded synchronously from the service, provider states are injectable for tests, the destination row shows provider name + folder with a "Change" affordance, folder-configure failures surface as an error row with a recovery suggestion (previously swallowed by an empty catch), and the active provider resolves from configuration instead of a hardcoded availableProviders.first.

Manifesto review

Reviewed against MANIFESTO.md, corollary by corollary, since backups are explicitly governed by it. This is a navigation and copy restructure: backup payloads, encryption, and every action's mechanics are untouched. C1 — no bulk operation added; nothing touches per-item safety fields. C2/C3 — no new logging, telemetry, or error channels near duress features; the one new error surface (auto-backup folder configuration failures, previously swallowed by an empty catch) reports storage-provider errors only. C4 — device authentication still gates every operation that loads or uses the backup key: export, password set/change, the auto-backup screen, and restore imports all authenticate exactly as before; the new un-gated hub adds navigation, not capability. C5 — the hub banner shows backup recency and kind, never contents; no enumeration of protected items. C6 — no undo, no audit surface. C7 — no protective default flipped; auto-backup remains opt-in and its configuration remains behind device auth. C8 — no sensitive operation lost a step: merging the sidebar items removes a hop between two navigation screens, while every export, restore, and password flow retains its full sequence including authentication; the password screen reframe changes verbs ("Generate Key" → "Set Backup Password"), not gates. C9 — backup surfaces never referenced duress features; unchanged. C10 — backup, export, and transfer payloads are byte-identical. One visibility change flagged deliberately: the last-backup banner (date + kind) is now visible without device auth, where the old Backup screen showed nothing pre-auth. Weighed against C4/C7: the same fact is already discoverable without auth (the Restore screen is un-gated today; auto-backup files are visible in the Files app), the banner reveals neither destination, contents, nor protected-item structure, and surfacing backup staleness is itself a data-loss protection.

Testing

• Full iOSAllTests plan passes locally on iPhone 18 Pro Max / iOS 27.0.
• New suites: AutoBackupViewModelTests (19 tests), AutoBackupViewSnapshotTests (7 scenarios — the coverage Snapshot the rebuilt backup and encryption-edit screens #573 deferred), LastBackupSummaryViewSnapshotTests (4, with an injectable now for deterministic staleness).
• Re-recorded and visually reviewed: BackupKeyChangeViewSnapshotTests, BackupViewSnapshotTests (hub + export), VaultMainNavigationViewSnapshotTests.
• Simulator walk-through of the full flow passed: single sidebar entry, hub layout, every push/back/sheet, and every auth gate failing closed.
• Not automatable (per Rebuild the last two non-Form screens, and drop the folder picker wrapper #556): a real folder pick through .fileImporter — needs one manual run with iCloud Drive.

🤖 Generated with Claude Code