Back up file uploads (tar → zstd → age)

Produce a second artefact per file target, through the same storage, R2, and retention pipeline as the dumps.

• Host path (bur.path): tar the path directly, since bur on the host can read it.
• Named volume (bur.volume): tar it via a throwaway read-only container (docker run --rm -v VOL:/data:ro …).
• Stream tar into zstd into age to produce app-<ts>.files.tar.zst.age, reusing the local write, R2 push, and retention. The stream is pipefail-checked, so a tar failure fails the artefact.

Acceptance

• an Issues backup produces both issues-<ts>.dump.age and issues-<ts>.files.tar.zst.age.
• the named-volume path works via the throwaway container.
• retention and R2 push treat file artefacts the same as dumps.