Copy backups to R2 and restore from them

Give every backup a second copy on Cloudflare R2, and let restore pull from it.

• storage.py gains an R2 section using rclone: push(local, app, name), list_remote(app), and cat_remote(app, name) -> stream. Credentials live in rclone's own config (mode 600), so bur never holds the R2 secret.
• Each backup pushes both artefacts (the dump and the globals) to R2 after the local write, along with the age-encrypted state file, and records pushed_offsite. If the push fails, pushed_offsite is false, the status is degraded, the database stays due for the next push, and the local copy is never lost.
• Restore pulls the local copy if present, otherwise from R2, then decrypts and restores; --drill works against an R2-sourced backup too. bur list and status show whether each backup is also in R2.

Provisioning the bucket is a setup step, not part of this ticket (see README §9): the bucket, a bucket-scoped create/write token, and a lifecycle rule that expires objects well after the keep-last-N window (roughly 3 to 4 times N times the cadence in days), padded so a multi-day outage can't delete the off-site copies down to zero, are all configured by hand in the Cloudflare dashboard.

Acceptance

• after bur backup, the dump and globals exist in R2 under <app>/, and the encrypted state file is copied too.
• a push failure is surfaced and leaves the status degraded, with the local copy retained.
• with the local copy deleted, bur restore APP --latest restores from R2, and --drill does too.