Back up and restore one database

Back up a single Postgres-in-Docker database to an encrypted local file (the DB dump plus the cluster globals it needs to be usable) and restore it into a throwaway container.

Proves the core mechanics everything else builds on:

• exec-based pg_dump/pg_restore so each DB is dumped by its own client version, needing no DB password on the host;
• age streaming encryption with a real pipefail check;
• custom-format restore behind --single-transaction;
• the three pure, unit-tested helpers (filenames, keep-last-N retention, config).

Done when: bur backup --only <app> writes an encrypted <app>-<ts>.dump.age and a paired <app>-<ts>.globals.sql.age under /backups/<app>/, and bur restore <app> --drill restores globals-then-dump into a fresh container — yielding a database the app could actually log into — with the expected tables present and non-zero rows.