Fix automatic database backups before upgrades

Self-hosted instances take a database snapshot before applying upgrade migrations, but a version mismatch had silently prevented it from completing, and snapshots were not kept across upgrades.

• Fixed the pre-upgrade database backup so it completes and persists in a dedicated storage volume across upgrades
• Added clear log output when a backup fails, with an optional strict mode (REQUIRE_BACKUP) that halts the upgrade instead of continuing without one
• Limited backups to one per version with automatic cleanup so they never fill the server disk