feat: device backup/restore + quick wins + username casing

Backup / restore flow:
- deviceBackup.ts: v2 format wrapping userId + deviceId + privateKey in
  an encrypted JSON payload so restore can re-seed localStorage, vault,
  and reattach to the existing server-side device row without provisioning
  a new one (conv-key bundles stay valid, no "awaiting key" state)
- shared/auth: restoreDeviceFromServerRecord — verifies session.user.id
  matches the backup's userId, confirms the server device row still
  exists, then writes the private key into the local secret store
- BackupExportDialog — passphrase + confirm, generates portable string,
  copy + download .txt
- DeviceRestore — textarea + passphrase → seeds vault + writes
  deviceId cache, treats this install as the original device
- DevicePage now has tabs "Neu einrichten" / "Backup wiederherstellen"
- BackupPromptBanner — post-registration nudge, reads sessionStorage
  signal from fresh provisions and persists "never-ask-again" in
  localStorage so it stops nagging
- SettingsPage backup section: uses the new dialog; removes the
  dangerous in-place key import (restore now lives in the device flow)

Username casing:
- Migration 20260420000002 drops lower() from the handle_new_user trigger
  and widens the regex to [A-Za-z0-9_]. profiles.username is citext so
  uniqueness + lookups stay case-insensitive regardless of stored casing
- Shared auth: trim() only, no toLowerCase on signup/lookups/search.
  ilike handles CI anyway and citext makes client normalisation redundant
- AuthPage regex + input preserve case, FriendsPage search preserves case
- i18n (de+en): updated username_hint / username_invalid / ERR_USERNAME_INVALID
  to reflect the new rule

Quick wins:
- React Router v7 future flags (v7_startTransition + v7_relativeSplatPath)
  set on BrowserRouter — silences the upgrade warning
- appUpdates.checkForUpdate: swallow benign network/fetch/"could not
  fetch valid release JSON" cases silently instead of console spam
- osNotify: persist an "asked" marker in localStorage so the permission
  prompt only fires once per install (OS already persists the answer,
  but the plugin re-queries loudly otherwise)

packages/shared/src/i18n/locales/de/auth.json

@@ -30,8 +30,8 @@
     "email_placeholder": "du@beispiel.de",
     "username": "Benutzername",
     "username_placeholder": "dennis",
-    "username_hint": "Damit meldest du dich an. Nur Kleinbuchstaben.",
-    "username_invalid": "Kleinbuchstaben a–z, Ziffern, Unterstrich · 3–32 Zeichen.",
+    "username_hint": "Damit meldest du dich an. Groß-/Kleinschreibung bleibt, ist aber nicht unterscheidbar (dennis = Dennis).",
+    "username_invalid": "Buchstaben, Ziffern oder Unterstrich · 3–32 Zeichen.",
     "invite_code": "Einladungscode",
     "invite_hint": "Pflichtfeld · Zugang nur auf Einladung."
   },

packages/shared/src/i18n/locales/de/errors.json

@@ -3,7 +3,7 @@
   "network": "Netzwerkfehler. Prüfe deine Verbindung.",
   "ERR_NOT_AUTH": "Du bist nicht angemeldet.",
   "ERR_INVITE_CODE_REQUIRED": "Einladungscode ist erforderlich.",
-  "ERR_USERNAME_INVALID": "Benutzername muss aus Kleinbuchstaben a–z, Ziffern oder Unterstrich bestehen (3–32 Zeichen).",
+  "ERR_USERNAME_INVALID": "Benutzername darf nur aus Buchstaben (A–Z, a–z), Ziffern oder Unterstrich bestehen (3–32 Zeichen).",
   "ERR_INVITES_DISABLED": "Registrierungen sind derzeit vom Admin deaktiviert.",
   "ERR_INVITE_NOT_FOUND": "Einladungscode nicht gefunden.",
   "ERR_INVITE_DISABLED": "Diese Einladung wurde deaktiviert.",