Harden restic backup workflow - #36

…aintenance

Make the restic backup pipeline more robust, safer and easier to monitor:

- Locking: switch to advisory fcntl.flock locks so stale locks from crashed
  runs no longer block new runs; record PID/host/time diagnostics
- Guard against empty/unmounted sources via a pre-backup min_source_entries
  check (new EmptySourceError) to avoid near-empty snapshots and data loss
- Parse restic snapshots/diff/find via --json instead of fragile text
  scraping; require the terminating diff statistics message
- Recover once from stale repository locks (ResticRepositoryLockedError +
  is_lock_error) without overriding a genuinely concurrent run
- Reorder maintenance to forget -> check -> prune; only prune when the repo
  check is clean; add configurable check_read_data_subset
- Add independent added/altered/deleted thresholds (new addition_threshold)
  and alert on any change type within monitored folders
- Move all notification logic into BackupScript (ResticClient no longer sends
  mail); send a single failure mail per run with a cumulative session log
- Raise VerificationError on verification failure; drop unused detailed_report
- Update tests accordingly

Co-authored-by: Cursor <cursoragent@cursor.com>

create_lock now logs via logger.exception (not logger.error), so update the
two "lock already held" tests to assert the correct logging call.

Co-authored-by: Cursor <cursoragent@cursor.com>