Add standalone backup script and admin update-check banner

ops/backup.sh snapshots LDAP (slapcat), Redis (BGSAVE, dynamic RDB path
lookup), and ./config for standalone deployments, with retention. A
background service polls GitHub releases every 24h and surfaces an
admin-only banner in the UI when a newer version is published.

nodejs/conf/base.js

@@ -52,4 +52,11 @@ module.exports = {
 		pass: '__in secrets file__',
 		from: 'SSO Manager <noreply@example.com>',
 	},
+	service: {
+		updateCheck: {
+			enabled: true,
+			initial: 30000,      // first check 30s after start
+			interval: 86400000,  // then every 24h
+		},
+	},
 };