feat(backup): add media offload data layer
Add the data substrate for media offload only: config state, durable ledger reads/writes, measurement helpers, and regression tests. This does not add offload behavior or consumers yet.
The ledger is JSONL rather than sqlite because *.sqlite* is excluded from backups while health/ is included; losing the journal must not lose the map to the owner's only media copy. Ledger appends are fsync'd unlike the neighboring pruning audit because this is a pre-delete witness, not a post-hoc audit.
Ledger files partition by media day, not write date, so per-file append order is a total order per segment. The fold key is append order; timestamps are informational only.
Per-file records use sha256 rather than the deletion audit's hash because this durable schema rides encrypted backups and may be read years later by restore flow. name and bytes stay aligned so one computed record can feed both consumers with only a key remap.
last_offload and last_verification use reason rather than last_backup and last_prune's error_reason because skipped and stalled are not errors.