cli: avoid data-dir initialization for version; create db parent dirs; redact generated passwords in CLI output

- Prevent 'nx9-wg version' from creating data directories by avoiding database initialization.
- Create parent directories when an explicit --database path is provided.
- Redact printed generated administrator passwords; announce file path or redact instead.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

crates/nx9-wg-api/tests/test_backup_and_restore.rs

@@ -0,0 +1,91 @@
+//! Integration test suite for Backup and Restore engine.
+
+use nx9_wg_api::backup::BackupService;
+use nx9_wg_core::types::network::Network;
+use nx9_wg_core::validation::validate_cidr;
+use nx9_wg_db::Store;
+use tempfile::tempdir;
+use uuid::Uuid;
+
+#[tokio::test]
+async fn test_backup_create_verify_and_restore() {
+    let dir = tempdir().expect("create temp dir");
+    let active_db_path = dir.path().join("active.db");
+    let backup_dir = dir.path().join("backups");
+    let safety_dir = dir.path().join("safety");
+
+    let store = Store::connect(&active_db_path.to_string_lossy())
+        .await
+        .expect("connect to db");
+    store.migrate().await.expect("run migrations");
+
+    // Insert test record
+    let net = Network {
+        id: Uuid::new_v4(),
+        name: "test_lan".to_string(),
+        cidr: validate_cidr("10.50.0.0/24").unwrap(),
+        enabled: true,
+        description: Some("LAN subnet".to_string()),
+        created_at: chrono::Utc::now().naive_utc(),
+        updated_at: chrono::Utc::now().naive_utc(),
+    };
+    store.create_network(&net).await.expect("create network");
+
+    // Create Backup
+    let (meta, backup_file) = BackupService::create_backup(
+        &store,
+        &backup_dir,
+        Some("Test backup snapshot"),
+        "test_admin",
+        Some("127.0.0.1"),
+    )
+    .await
+    .expect("create backup");
+
+    assert!(backup_file.exists());
+    assert!(meta.size_bytes > 0);
+    assert!(!meta.checksum.is_empty());
+
+    // Verify Backup
+    let is_valid =
+        BackupService::verify_backup(&backup_file, Some(&meta.checksum)).expect("verify backup");
+    assert!(is_valid, "Backup file should be valid SQLite archive");
+
+    // List backups from store
+    let backups = store.list_backups().await.expect("list backups");
+    assert_eq!(backups.len(), 1);
+    assert_eq!(backups[0].id, meta.id);
+
+    // Modify active DB by adding another network
+    let net2 = Network {
+        id: Uuid::new_v4(),
+        name: "temporary_lan".to_string(),
+        cidr: validate_cidr("10.99.0.0/24").unwrap(),
+        enabled: true,
+        description: None,
+        created_at: chrono::Utc::now().naive_utc(),
+        updated_at: chrono::Utc::now().naive_utc(),
+    };
+    store.create_network(&net2).await.expect("create net2");
+    assert_eq!(store.list_networks().await.unwrap().len(), 2);
+
+    // Restore Backup
+    BackupService::restore_backup(
+        &store,
+        &backup_file,
+        &active_db_path,
+        &safety_dir,
+        "test_admin",
+        None,
+    )
+    .await
+    .expect("restore backup");
+
+    // Reopen store to verify restored content
+    let restored_store = Store::connect(&active_db_path.to_string_lossy())
+        .await
+        .expect("reconnect store");
+    let restored_networks = restored_store.list_networks().await.expect("list restored");
+    assert_eq!(restored_networks.len(), 1);
+    assert_eq!(restored_networks[0].name, "test_lan");
+}