feat: fix export/import, add backup download/upload, restore service checkboxes

- export_config: clean output (no internal _keys), identity exposed as 'identity'
- import_config: handle 'identity' key, merge into existing config (not replace)
- restore_config: accept optional services list for selective restore
- backup_config: include 'identity' in manifest services list
- new GET /api/config/backups/<id>/download → zip file download
- new POST /api/config/backup/upload → zip file upload
- webui: Download + Upload buttons, restore modal with per-service checkboxes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/app.py

@@ -12,10 +12,13 @@ Provides REST API endpoints for managing:
 """
 
 import os
+import io
 import json
+import zipfile
+import shutil
 import logging
 from datetime import datetime
-from flask import Flask, request, jsonify, current_app
+from flask import Flask, request, jsonify, current_app, send_file
 from flask_cors import CORS
 import threading
 import time
@@ -998,9 +1001,11 @@ def list_config_backups():
 
 @app.route('/api/config/restore/<backup_id>', methods=['POST'])
 def restore_config(backup_id):
-    """Restore configuration from backup."""
+    """Restore configuration from backup. Body may contain {services: [...]} for selective restore."""
     try:
-        success = config_manager.restore_config(backup_id)
+        data = request.get_json(silent=True) or {}
+        services = data.get('services')  # None = full restore
+        success = config_manager.restore_config(backup_id, services=services)
         if success:
             service_bus.publish_event(EventType.RESTORE_COMPLETED, 'api', {
                 'backup_id': backup_id,
@@ -1044,6 +1049,56 @@ def import_config():
         logger.error(f"Error importing config: {e}")
         return jsonify({"error": str(e)}), 500
 
+@app.route('/api/config/backups/<backup_id>/download', methods=['GET'])
+def download_backup(backup_id):
+    """Download a backup as a zip file."""
+    try:
+        from pathlib import Path
+        backup_path = config_manager.backup_dir / backup_id
+        if not backup_path.exists():
+            return jsonify({'error': f'Backup {backup_id} not found'}), 404
+        buf = io.BytesIO()
+        with zipfile.ZipFile(buf, 'w', zipfile.ZIP_DEFLATED) as zf:
+            for f in backup_path.rglob('*'):
+                if f.is_file():
+                    zf.write(f, f.relative_to(backup_path))
+        buf.seek(0)
+        return send_file(buf, mimetype='application/zip',
+                         as_attachment=True,
+                         download_name=f'{backup_id}.zip')
+    except Exception as e:
+        logger.error(f"Error downloading backup: {e}")
+        return jsonify({'error': str(e)}), 500
+
+@app.route('/api/config/backup/upload', methods=['POST'])
+def upload_backup():
+    """Upload a backup zip file."""
+    try:
+        if 'file' not in request.files:
+            return jsonify({'error': 'No file provided'}), 400
+        f = request.files['file']
+        filename = f.filename or ''
+        if filename.endswith('.zip'):
+            backup_id = filename[:-4]
+        else:
+            backup_id = f"backup_{datetime.utcnow().strftime('%Y%m%d_%H%M%S')}"
+        backup_id = ''.join(c for c in backup_id if c.isalnum() or c == '_')
+        backup_path = config_manager.backup_dir / backup_id
+        backup_path.mkdir(parents=True, exist_ok=True)
+        try:
+            with zipfile.ZipFile(io.BytesIO(f.read())) as zf:
+                zf.extractall(backup_path)
+        except zipfile.BadZipFile:
+            shutil.rmtree(backup_path, ignore_errors=True)
+            return jsonify({'error': 'Invalid zip file'}), 400
+        if not (backup_path / 'manifest.json').exists():
+            shutil.rmtree(backup_path, ignore_errors=True)
+            return jsonify({'error': 'Invalid backup: missing manifest.json'}), 400
+        return jsonify({'backup_id': backup_id})
+    except Exception as e:
+        logger.error(f"Error uploading backup: {e}")
+        return jsonify({'error': str(e)}), 500
+
 @app.route('/api/config/backups/<backup_id>', methods=['DELETE'])
 def delete_config_backup(backup_id):
     """Delete a configuration backup."""