feat(cli): cmd_backup_export — pack vault into .relbak

Reads the vault layout from disk, prompts for backup passphrase
(zxcvbn-gated, independent of the live vault key), tars .git/
unless --no-history, optionally bundles the reference JPEG, and
atomic-writes the .relbak. Leaves .relicario/last_backup marker
for cmd_status.

crates/relicario-cli/Cargo.toml

@@ -24,6 +24,7 @@ serde_json = "1"
 zeroize = "1"
 url = "2"
 data-encoding = "2"
+tar = { version = "0.4", default-features = false }
 
 [dev-dependencies]
 assert_cmd = "2"