feat(api): integrate identity, notification scope and connection settings into control plane

- Wire identity, metrics and update services into the assembled API.

- Add connection authorization modes and scoped console authorization.

- Preserve notification group IDs for filtered delivery.

- Extend maintenance, backup, resource and module flows with runtime metadata and upstream safety.

apps/api/src/interface/http/system-routes.ts

@@ -161,7 +161,7 @@ export function registerSystemRoutes(app: FastifyInstance, options: SystemRoutes
 
   app.get(
     '/api/v1/system/component-backups/catalog',
-    wrap(async () => ({ items: backups().catalog() })),
+    wrap(async () => ({ items: backups().catalog(), directory: backups().directory() })),
   );
   app.get(
     '/api/v1/system/component-backups/auto/settings',
@@ -196,6 +196,26 @@ export function registerSystemRoutes(app: FastifyInstance, options: SystemRoutes
     '/api/v1/system/component-backups/:filename/preview',
     wrap(async (request) => backups().preview((request.params as { filename: string }).filename)),
   );
+  app.get(
+    '/api/v1/system/component-backups/:filename/download',
+    wrap(async (request, reply) => {
+      const backup = await backups().backupFile((request.params as { filename: string }).filename);
+      if (!backup)
+        return reply.code(404).type('application/problem+json').send({
+          type: 'about:blank',
+          title: 'Not Found',
+          status: 404,
+          code: 'COMPONENT_BACKUP_NOT_FOUND',
+          detail: 'The requested component backup file no longer exists.',
+          requestId: request.id,
+        });
+      reply
+        .header('content-disposition', `attachment; filename="${backup.filename}"`)
+        .header('content-length', String(backup.sizeBytes))
+        .type('application/octet-stream');
+      return createReadStream(backup.path);
+    }),
+  );
   app.post(
     '/api/v1/system/component-backups/:filename/restore',
     { bodyLimit: 8_192 },