fix(backups): skip stateless services during project policy fan-out

[chbndrhnns]

Summary

Excludes stateless services (services without persistent volumes or supported database engines) when fanning out a project-default backup policy, preventing recurring false-alarm failures and batch status corruption.

Motivation

When a backup policy is configured at the project level (policy.serviceId === null), BackupOrchestrator.enqueue() fans out across all enabled services in the project and spawns a backup_run for each one.

In multi-service projects (such as compose stacks with web, api, workers, reverse proxies, dashboards), stateless companion services almost never declare volumes or persistent bind mounts. When their backup runs execute, VolumeCopyProducer throws:
Nothing to back up: no volumes or bind mounts found for service "<service>"...

This causes two critical issues:

1. Every scheduled cron tick records recurring failed runs for completely stateless services.
2. In latestByPolicy, because the batch status is marked failed if any child run failed (batchRuns.some(r => r.status === "failed")), a single stateless frontend or monitor marks the whole project's nightly backup as failed—even when companion database services (e.g. Postgres, Redis, volume mounts) succeeded.

Explicit per-service backup policies (policy.serviceId !== null) retain the fail-closed error behavior from #611 when a user explicitly targets a service that lacks storage.

Related issue

Closes #859

Changes

• apps/api:
  • backup.orchestrator.ts: Add isBackupCandidateService helper checking whether a service has a recognized database image (detectDbImage), declared volumes (service.volumes), or an explicit custom command/path payload.
  • backup.orchestrator.ts: Filter project-default fan-out to only candidate services. If a project has no candidate services at all, fail fast with a clear diagnostic message rather than spawning doomed runs.
  • triggers/cron.ts: Handle enqueue skip gracefully in recurring tick handler with a warning log instead of throwing unhandled errors.
• apps/api/test:
  • backup-run-durability.test.ts: Add test verifying stateless services are skipped during project fan-out while stateful services are enqueued.
  • backup-run-durability.test.ts: Add test verifying an error is thrown when a project has no persistent services.

Verification

Ran all backup test suites in apps/api/test/modules/backups/:

$ bun run test test/modules/backups/
Test Files  21 passed (21)
     Tests  240 passed (240)

Typechecked and formatted:

$ bun x tsc -p tsconfig.json --noEmit
$ bun x prettier --check apps/api/src/modules/backups/backup.orchestrator.ts apps/api/src/modules/backups/triggers/cron.ts apps/api/test/modules/backups/backup-run-durability.test.ts
All matched files use Prettier code style!

Checklist

• One change per PR — one bug, or one agreed feature, with nothing unrelated bundled in
• The diff is scoped — no reformatting or lint fixes on lines I wasn't otherwise changing
• A test fails without this change and passes with it
• bun run test, tsc, and bun format all pass locally
• I understand every line of this diff and can explain it in review