feat(m14): backup & admin (zip via fflate, admin guard, tests, e2e)

- BackupService (admin-only: createBackup zips DB+uploads via fflate to
  backups/backup-<ts>.zip, listBackups newest-first, getBackupPath with
  path-traversal guard)
- Admin backup APIs: GET/POST /api/admin/backups, GET /api/admin/backups/:filename
- Admin backups screen (admin-only) + BackupCreateButton
- Playwright globalSetup seeds a system_admin user for admin E2E
- add fflate dependency
- Unit tests (BackupService: zip content, list, admin guard, traversal) +
  e2e backup (create/list/download + non-admin 403)

tests/e2e/backup.spec.ts

@@ -0,0 +1,61 @@
+import { test, expect, type Page } from '@playwright/test';
+
+async function login(page: Page, email: string, password: string) {
+  await page.goto('/login');
+  await page.getByLabel('メールアドレス').fill(email);
+  await page.getByLabel('パスワード').fill(password);
+  await page.getByRole('button', { name: 'ログイン' }).click();
+  await expect(page).toHaveURL(/\/dashboard/);
+}
+
+test.describe('backup & admin', () => {
+  test('admin creates, lists, and downloads a backup; non-admin is forbidden', async ({
+    browser,
+    request,
+  }) => {
+    // 管理者(globalSetup で seed 済み)でログイン
+    const adminContext = await browser.newContext();
+    const adminPage = await adminContext.newPage();
+    await login(adminPage, 'admin@example.com', 'admin123');
+
+    // バックアップ一覧画面
+    await adminPage.goto('/admin/backups');
+    await expect(
+      adminPage.getByRole('heading', { name: '管理者: バックアップ' })
+    ).toBeVisible();
+
+    // バックアップ作成(API)
+    const createRes = await adminPage.request.post('/api/admin/backups');
+    expect(createRes.ok()).toBeTruthy();
+    const { backup } = (await createRes.json()) as {
+      backup: { filename: string };
+    };
+
+    // 一覧に表示
+    await adminPage.reload();
+    await expect(
+      adminPage.getByTestId(`backup-${backup.filename}`)
+    ).toBeVisible();
+
+    // ダウンロード(API)
+    const dlRes = await adminPage.request.get(
+      `/api/admin/backups/${backup.filename}`
+    );
+    expect(dlRes.status()).toBe(200);
+    expect(dlRes.headers()['content-type']).toContain('application/zip');
+
+    // 非管理者は403
+    const memberEmail = `member-${Date.now()}@example.com`;
+    await request.post('/api/auth/register', {
+      data: { name: 'Member', email: memberEmail, password: 'password123' },
+    });
+    const memberContext = await browser.newContext();
+    const memberPage = await memberContext.newPage();
+    await login(memberPage, memberEmail, 'password123');
+    const forbidden = await memberPage.request.get('/api/admin/backups');
+    expect(forbidden.status()).toBe(403);
+
+    await adminContext.close();
+    await memberContext.close();
+  });
+});

tests/e2e/globalSetup.ts

@@ -0,0 +1,34 @@
+import bcrypt from 'bcrypt';
+import fs from 'node:fs';
+import path from 'node:path';
+import { SqliteDatabase } from '@/lib/db/sqlite';
+import { Migrator } from '@/lib/db/migrator';
+import { UserRepository } from '@/repositories/UserRepository';
+
+const ADMIN_EMAIL = 'admin@example.com';
+const ADMIN_PASSWORD = 'admin123';
+
+/**
+ * E2E用の初期データをセットアップする。
+ * - Migrationを確実に適用(開発サーバのmigrateと重複しても冪等)
+ * - バックアップ/管理者機能のE2Eで使用する system_admin ユーザーを生成
+ */
+export default async function globalSetup(): Promise<void> {
+  const dbPath = process.env.SQLITE_PATH ?? './data/app.db';
+  fs.mkdirSync(path.dirname(dbPath), { recursive: true });
+
+  const db = new SqliteDatabase(dbPath);
+  const migrationsDir = path.join(process.cwd(), 'lib', 'db', 'migrations');
+  new Migrator(db, migrationsDir).migrate();
+
+  const userRepo = new UserRepository(db);
+  if (!userRepo.findByEmail(ADMIN_EMAIL)) {
+    userRepo.create({
+      name: 'Admin',
+      email: ADMIN_EMAIL,
+      passwordHash: bcrypt.hashSync(ADMIN_PASSWORD, 10),
+      role: 'system_admin',
+    });
+  }
+  db.close();
+}