Clean up documentation structure and links

docs/BACKUP_RESTORE.md

@@ -0,0 +1,50 @@
+# Backup and Disaster Recovery Guide
+
+## Architecture
+
+`nx9-wg` uses SQLite `VACUUM INTO` for atomic, consistent online snapshots of the database while the service is live.
+
+---
+
+## 1. Creating a Backup
+
+### Via CLI
+```bash
+nx9-wg backup create --description "Routine weekly backup"
+```
+
+### Via REST API
+```bash
+curl -X POST http://127.0.0.1:8080/api/v1/backups/create \
+  -H "Authorization: Bearer nx9_<TOKEN>" \
+  -H "Content-Type: application/json" \
+  -d '{"description": "Pre-maintenance backup"}'
+```
+
+---
+
+## 2. Verifying a Backup
+
+The verification process:
+1. Validates minimum file size.
+2. Checks the SQLite 3 magic header bytes (`b"SQLite format 3\0"`).
+3. Validates the SHA-256 cryptographic checksum against the manifest.
+
+```bash
+nx9-wg backup verify /var/lib/nx9-wg/backups/nx9-backup-20260816-120000.db
+```
+
+---
+
+## 3. Restoring from a Backup
+
+The restore workflow is designed with fail-safety:
+1. Verifies the backup archive before performing any modifications.
+2. Creates an automatic pre-restore safety snapshot (`pre-restore-safety-TIMESTAMP.bak`).
+3. Closes open connection pools and replaces the database file.
+4. Cleans stale WAL and SHM journal files.
+5. Reopens the database and runs the Reconciliation Engine to bring kernel WireGuard and firewall state in sync with the restored database.
+
+```bash
+nx9-wg backup restore /var/lib/nx9-wg/backups/nx9-backup-20260816-120000.db
+```