Back up one database to encrypted local files (bur backup --only)

Wire the single-database local path in runner.py and cli.py: dump, encrypt, write locally, record the result. This is the first integration of the dump and restore wrappers, age, and storage.

• Produces two artefacts that share the run timestamp: <app>-<ts>.dump.age and the paired <app>-<ts>.globals.sql.age, so they restore together.
• Free-space guard. Before the local write, check backup_root free space against a conservative floor (raw pg_database_size, deliberately over-provisioned, rather than a predicted compressed size that can't be known before dumping) and abort that DB loudly if there isn't room. Stream to a .partial and handle a full disk (ENOSPC) mid-stream by failing the DB and unlinking the partial. A backup must never fill the VPS disk.
• Streaming pipefail is enforced on both streams. --dry-run writes nothing.

Acceptance

• bur backup --only giftring produces the dump and the matching globals artefact.
• a truncated stream fails with a non-zero exit.
• the free-space guard aborts loudly when short, and never fills the disk.
• --dry-run performs no writes.