feat: add Network Backup section to Database Management

PC2 can now automatically pull and restore a fresh copy of PC1's database
on a daily schedule. Config and API key are stored in local JSON files so
they survive database restores.

- New networkSyncConfigService: file-based config (network-backup-key.json,
  network-sync-config.json) that persists through DB restores
- New networkSyncService: streams live pg_dump from source PC over HTTP and
  pipes into psql, then reconnects Prisma and applies missing migrations
- 6 new endpoints: get/regenerate API key, serve backup stream (key-auth
  only), get/save sync config, trigger immediate sync
- Hourly cron job that fires only when current hour matches configured syncHour
- NetworkBackupManager component: shows this machine's key (show/copy/regen)
  and receiver config (enable toggle, hour picker 0-23, source URL + key,
  Save + Sync Now, last sync status)
- README setup guide for both PCs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/Backend/src/routes/database-management.ts

@@ -7,6 +7,13 @@ import multer from "multer";
 import { prisma } from "@repo/db/client";
 import { storage } from "../storage";
 import { backupDatabaseToPath } from "../services/databaseBackupService";
+import {
+  getOrCreateApiKey,
+  regenerateApiKey,
+  readSyncConfig,
+  writeSyncConfig,
+} from "../services/networkSyncConfigService";
+import { runNetworkSync } from "../services/networkSyncService";
 
 const MIGRATIONS_DIR = path.resolve(__dirname, "../../../../packages/db/prisma/migrations");
 
@@ -471,4 +478,97 @@ router.post("/restore", restoreUpload.single("file"), async (req: Request, res:
   }
 });
 
+// ==============================
+// Network Backup — Source Role
+// ==============================
+
+// GET /network-backup-key — return (or auto-generate) this machine's API key
+router.get("/network-backup-key", async (req, res) => {
+  if (!req.user?.id) return res.status(401).json({ error: "Unauthorized" });
+  res.json({ apiKey: getOrCreateApiKey() });
+});
+
+// POST /network-backup-key/regenerate — generate a new key
+router.post("/network-backup-key/regenerate", async (req, res) => {
+  if (!req.user?.id) return res.status(401).json({ error: "Unauthorized" });
+  res.json({ apiKey: regenerateApiKey() });
+});
+
+// GET /network-backup — streams a live pg_dump; authenticated by API key header only
+router.get("/network-backup", async (req: Request, res: Response): Promise<any> => {
+  const providedKey = req.headers["x-network-backup-key"] as string | undefined;
+  if (!providedKey) return res.status(401).json({ error: "Missing X-Network-Backup-Key header" });
+
+  const storedKey = getOrCreateApiKey();
+  if (providedKey !== storedKey) return res.status(401).json({ error: "Invalid API key" });
+
+  const pg = spawn(
+    "pg_dump",
+    [
+      "--no-acl", "--no-owner",
+      "-h", process.env.DB_HOST || "localhost",
+      "-U", process.env.DB_USER || "postgres",
+      process.env.DB_NAME || "dental_db",
+    ],
+    { env: { ...process.env, PGPASSWORD: process.env.DB_PASSWORD } }
+  );
+
+  res.setHeader("Content-Type", "application/octet-stream");
+  res.setHeader(
+    "Content-Disposition",
+    `attachment; filename="network_backup_${Date.now()}.sql"`
+  );
+
+  pg.stdout.pipe(res);
+
+  let stderr = "";
+  pg.stderr.on("data", (d) => (stderr += d.toString()));
+  pg.on("error", (err) => {
+    if (!res.headersSent)
+      res.status(500).json({ error: "pg_dump failed", details: err.message });
+  });
+  pg.on("close", (code) => {
+    if (code !== 0) console.error("pg_dump for network backup failed:", stderr);
+  });
+});
+
+// ==============================
+// Network Backup — Receiver Role
+// ==============================
+
+// GET /network-sync-config
+router.get("/network-sync-config", (req, res) => {
+  if (!req.user?.id) return res.status(401).json({ error: "Unauthorized" });
+  res.json(readSyncConfig());
+});
+
+// PUT /network-sync-config
+router.put("/network-sync-config", (req: Request, res: Response): any => {
+  if (!req.user?.id) return res.status(401).json({ error: "Unauthorized" });
+  const { enabled, syncHour, sourceUrl, apiKey } = req.body;
+  const updated = writeSyncConfig({ enabled, syncHour, sourceUrl, apiKey });
+  res.json(updated);
+});
+
+// POST /network-sync-now — trigger an immediate pull sync
+router.post("/network-sync-now", async (req: Request, res: Response): Promise<any> => {
+  if (!req.user?.id) return res.status(401).json({ error: "Unauthorized" });
+
+  const config = readSyncConfig();
+  if (!config.sourceUrl || !config.apiKey) {
+    return res
+      .status(400)
+      .json({ error: "Source URL and API key must be configured before syncing" });
+  }
+
+  try {
+    await runNetworkSync(config.sourceUrl, config.apiKey);
+    writeSyncConfig({ lastSyncAt: new Date().toISOString(), lastSyncStatus: "success", lastSyncError: null });
+    res.json({ success: true, syncedAt: new Date() });
+  } catch (err: any) {
+    writeSyncConfig({ lastSyncAt: new Date().toISOString(), lastSyncStatus: "failed", lastSyncError: err.message });
+    res.status(500).json({ error: "Sync failed", details: err.message });
+  }
+});
+
 export default router;