Back up every database with per-DB isolation + prune

Turn the single-database path into the full loop, plus local retention.

• bur backup (no --only) iterates over every discovered database. One database's failure is caught, logged, and does not abort the others. The run aggregates a result and an exit code (non-zero if any failed). --only APP still targets a subset.
• After each successful backup, apply keep-last-N (retention.plan_retention) to the local files. bur prune runs it on its own, and --dry-run lists the deletions. N comes from bur.retention.keep (per database) or retention_keep (the global default). The most recent backup is never pruned.

Acceptance

• a forced failure on one database still backs up the rest; the overall exit is non-zero if any failed; each per-database outcome is logged.
• a run leaves only the newest N local copies per app; bur prune --dry-run lists without deleting.