feat: add network backup location awareness

[AJV20]

Summary

• lets users explicitly designate the configured backup folder as a network location
• reports designated destinations as Available, Offline, or Invalid and refreshes them on macOS mount/unmount events
• persists volume identity using the volume UUID when available plus a one-way hash of the credential-redacted remote source and filesystem type for UUID-less/reconnected shares
• fails closed before every backup/archive writer when the saved remote destination is absent, mismatched, inaccessible, or resolves outside the mounted share
• keeps scheduled backups due while their network destination is offline or invalid, then rechecks when the share returns
• preserves normal behavior for local and removable external disks

Safety details

• A missing /Volumes/<share> destination is never recreated as a directory on the startup disk.
• Destination symlinks are resolved during designation and every mutation preflight; paths escaping the saved remote mount are rejected.
• A different volume mounted at the saved mount path is Invalid rather than Offline.
• Full, incremental, native/fallback, archive-import, and backup deletion/recovery paths all use the same fail-closed preflight, including post-extraction rollback.
• Archive import snapshots the selected archive into app-owned temporary storage, then validates and extracts those same immutable bytes; symlink, hardlink, FIFO, and device members are rejected before the first destination mutation.
• Async designation is discarded if the configured folder changes before identity capture completes.
• Raw mount-source strings and credentials are not persisted; only a SHA-256 identity digest is stored.

Verification

• python3 Scripts/regression/run.py — 164 checks
• swift build
• swift build -c release
• bash Scripts/build.sh
• plutil -lint for all seven localizations
• Scripts/benchmark-performance.sh
• fresh built-app launch with one visible WindowServer window
• independent exact-staged-diff correctness/security and specification-compliance review

Scope

This is the focused mount-awareness portion of #52. The temporary local cache and verified migration queue remain intentionally deferred to a separate security-focused change.

[momenbasel]

Thanks for the substantial work here. I completed independent standards, spec, correctness, and security reviews. I cannot merge this safely in its current form:

• ArchiveSnapshot duplicates every selected archive into the system temporary volume, so importing or merely inspecting a large valid backup can require the full archive size again and exhaust the startup disk.
• A fast unmount/remount can cancel the offline refresh, then removeDuplicates suppresses the still-available completion, so backup reload, readiness, and scheduled retry never run.
• The generated Network Backup Location readiness items are filtered out by the current Readiness Center.
• The new network status UI bypasses the added localization keys.
• Retry/reconnect, configurable offline behavior, and pending manual-operation recovery remain outside the implemented scope.

The review also uncovered a pre-existing tar option-injection flaw in archive inspection. That flaw predates this PR, so I am not attributing it to this change; I am fixing it separately on main before release.

Fixing the introduced issues would require redesigning the immutable archive snapshot/capacity strategy and revalidating the mount-event state machine, which is beyond a safe maintainer patch to this PR. I am closing it instead of risking backup loss, disk exhaustion, or a misleading partially-working network mode.