Add secure backups and improve PDF hyphen selection

[dowellhz]

What changed

• Recognize PDF words split across visual lines even when the user selects only the suffix on the second line.
• Distinguish PDF layout hyphens from genuine known hyphenated words before saving vocabulary text.
• Add File menu actions for creating and restoring versioned Leaf Reader user-data backups.
• Snapshot the three user SQLite databases with SQLite's online backup API and include preferences plus managed reading-note assets.
• Validate backup manifests, SHA-256 checksums, SQLite integrity, payload paths, entry counts, byte limits, declared directories, and symbolic-link safety.
• Apply restores during cold startup before persistence singletons open, with a durable journal, rollback, and interrupted-restore recovery.
• Exclude Keychain items and current or legacy API-key preference fields from backups; preserve credentials already present on the current Mac during restore.
• Stop reader startup, document opening, text selection, and automatic embedding warmup from reading Keychain. Explicit AI, settings, diagnostics, and connection-test actions still read credentials on demand.
• Add focused regression coverage and update user, architecture, development, and security documentation.

Why

PDFKit may expose a line-wrapped word either with a newline or as text containing only a layout hyphen. The previous selection path could recover a word when the selected fragment ended in a hyphen, but selecting the suffix on the following line left the prefix undiscovered.

Leaf Reader also lacked a supported way to move or recover vocabulary, learning state, reading notes, note assets, sessions, conversations, and preferences. Copying live WAL files or replacing open databases would risk inconsistent or partial user data, so backups use verified SQLite snapshots and restoration is deferred to cold startup.

Credential availability checks were also reading Keychain during ordinary reader interactions. Credential access is now limited to explicit actions that actually need a secret.

Impact

• Saving a PDF word from either side of a visual line wrap recovers the complete word more reliably.
• Users can back up data from File > Back Up User Data... and schedule a validated restore from File > Restore User Data....
• Restore runs on the next launch before the reader window and databases are created.
• API keys are not portable through these backups and are never overwritten by restore.
• Automatic remote embedding warmup no longer reads Keychain; local credential-free embedding warmup remains available, while explicit remote AI actions continue to use stored credentials.

Validation

• ./tests/run.sh — all 154 logic tests passed, including backup round trip, tamper rejection, rollback, interrupted recovery, symlink rejection, credential deferral, and PDF hyphen cases
• ./scripts/check.sh --no-build — all checks passed
• ./scripts/check_ui_theme.sh --warnings-as-errors — passed
• ./scripts/build_app.sh — Debug arm64 app built and passed signing verification
• git diff --check — passed