feat(backup): write database dumps gzip-compressed

Dumps stream through gzip into <db>.backup.sql.gz; no uncompressed copy touches the disk. Restore reads gzip and plain dumps by their magic bytes, verifies a gzip dump to its end before anything is dropped, and still finds the uncompressed names of older generations. The manifest names the compression.

🎯 Fix: 92 %
💥 Break: 20 %
💸 Cost: –
⏱️ Time: –
🛡️ Security: ~100 %
🏆 Score: 74
🚦 Gate: ⛔ break 20 % > 5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -47,9 +47,13 @@ Backups are stored in a deterministic, fully nested structure:
             └── <volume-name>/
                 ├── files/
                 └── sql/
-                    └── <database>.backup.sql
+                    └── <database>.backup.sql.gz
 ```
 
+Dumps are gzip-compressed while they are written; no uncompressed copy
+touches the disk. Generations written before compression hold
+`<database>.backup.sql`; `baudolo-restore` reads both.
+
 ### Meaning of each level
 
 * `<machine-hash>`