Add live backup status reconciliation with NAS manifest

BackupStatusService (new singleton, ObservableObject, PHPhotoLibraryChangeObserver):
- Loads cached BackupStatusSnapshot instantly from UserDefaults on init
- Full reconcile: fetch phone assets → connect NAS → load/build manifest → compare
  → enforce invariant (alreadySafe ≤ phoneTotal), persist result
- Debounced (30s) for photo library changes; force=true bypasses debounce
- If NAS unreachable: keeps last cached numbers, marks connectionState = .offline
- PHPhotoLibraryChangeObserver triggers refresh on any library change

BackupManifest (new):
- Stored at {remotePath}/.kisani.json on NAS
- Indexed by localIdentifier (PHAsset stable ID); filename fallback for legacy entries
- Built from directory listing if manifest missing (bootstrap for existing backups)
- merged/updated after each backup run via NASTransferProtocol.writeData

BackupStatusSnapshot (new):
- Single source of truth: phoneTotal, alreadySafe, needBackup (derived), nasArchiveTotal,
  lastCheckedAt, connectionState
- Invariant enforced in service: alreadySafe = min(safe, phoneTotal)

Protocol / services:
- NASTransferProtocol: adds writeData(_ data: Data, to remotePath: String)
- SMBService: implements writeData via temp file + SMBClient.upload
- SFTPService: implements writeData via SFTP ByteBuffer write

BackupEngine:
- Tracks ManifestEntry per successful upload during backup loop
- After backup: calls BackupStatusService.refreshAfterBackup(entries:connection:)
  which applies optimistic UI update then writes manifest + triggers reconcile

BackupView:
- Reads all stats from BackupStatusService.snapshot (not vm/nasFileCount)
- Stats labels: "NAS Archive" / "On iPhone" / "Need Backup" / "Already Safe"
- Live refresh triggers: .task (force), scenePhase.active (force),
  nasReachable change (force), remotePath change (force), backup completed (+2s)
- Subtle status row below stats: "Checking…" spinner or "Updated X ago" with
  wifi-slash icon when NAS offline; tap refresh button for forced reconcile
- AppMenuView sheet now correctly passes engine EnvironmentObject

BackupViewModel: stripped to auth-only (photosAuthStatus + requestPhotosAccess)

Co-Authored-By: Kutesir <kutesir@provoc.ug>
Co-Authored-By: Sentry <sentry@provoc.ug>

Core/Models/BackupManifest.swift

@@ -0,0 +1,56 @@
+import Foundation
+
+struct ManifestEntry: Codable {
+    let localIdentifier: String   // PHAsset.localIdentifier — primary key
+    let filename: String
+    let creationDate: Date?
+    let fileSize: Int64
+    let remotePath: String
+    let uploadedAt: Date
+}
+
+struct BackupManifest: Codable {
+    static let remoteFilename = ".kisani.json"
+
+    var version: Int = 1
+    var lastUpdated: Date = Date()
+    var entries: [ManifestEntry] = []
+
+    // Primary match: stable PHAsset localIdentifier
+    func contains(localIdentifier id: String) -> Bool {
+        guard !id.isEmpty else { return false }
+        return entries.contains { $0.localIdentifier == id }
+    }
+
+    // Fallback: case-insensitive filename (for assets backed up before manifest existed)
+    func containsByFilename(_ name: String) -> Bool {
+        let lower = name.lowercased()
+        return entries.contains { $0.filename.lowercased() == lower }
+    }
+
+    // Merge new entries, replacing any existing record for the same localIdentifier
+    mutating func merge(entries newEntries: [ManifestEntry]) {
+        let newIds = Set(newEntries.map { $0.localIdentifier }.filter { !$0.isEmpty })
+        entries.removeAll { !$0.localIdentifier.isEmpty && newIds.contains($0.localIdentifier) }
+        entries.append(contentsOf: newEntries)
+        lastUpdated = Date()
+    }
+
+    // Bootstrap from a raw NAS directory listing (no localIdentifiers known)
+    static func buildFromNASListing(_ items: [NASItem]) -> BackupManifest {
+        var manifest = BackupManifest()
+        manifest.entries = items
+            .filter { !$0.isDirectory && $0.name != remoteFilename }
+            .map { item in
+                ManifestEntry(
+                    localIdentifier: "",
+                    filename: item.name,
+                    creationDate: item.modifiedDate,
+                    fileSize: item.size,
+                    remotePath: item.path,
+                    uploadedAt: item.modifiedDate ?? Date()
+                )
+            }
+        return manifest
+    }
+}