fix: harden managed online backup key handling

Require canonical encrypted envelopes and surface typed sanitized keyring corruption states.

Persist crash-durable primary and recovery files, prevalidate removal plans, isolate renderer refresh authority, and cover the real hidden Windows DPAPI and IPC composition.

renderer/styles.css

@@ -1983,6 +1983,28 @@ select.hs-input { max-width: none; width: auto; min-width: 140px; }
   text-align: center;
 }
 
+.online-backup-refresh-status {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 10px;
+  padding: 10px 12px;
+  border: 1px solid rgba(245, 158, 11, 0.35);
+  border-radius: 8px;
+  color: #fbbf24;
+  background: rgba(245, 158, 11, 0.08);
+}
+
+.online-backup-refresh-status[hidden] {
+  display: none;
+}
+
+.online-backup-refresh-status[data-state="error"] {
+  border-color: rgba(239, 68, 68, 0.35);
+  color: #fca5a5;
+  background: rgba(239, 68, 68, 0.08);
+}
+
 .online-backup-footer {
   display: flex;
   justify-content: flex-end;
@@ -3694,6 +3716,11 @@ input[type="checkbox"] {
   .online-backup-footer .btn {
     width: 100%;
   }
+
+  .online-backup-refresh-status {
+    align-items: stretch;
+    flex-direction: column;
+  }
 }
 
 #settings-view {