Address PR review: backup correctness/security + drop hardening

Fixes from the code review of this branch:

- Backup requires a running container (it runs via `docker exec`, which
  can't run on a stopped one). Removed the misleading "Backup" button
  from the stopped-project actions, added an explicit running check with
  a clear error, and corrected the doc comment. (H1)
- jq sanitization fallback no longer leaks secrets: if ~/.claude.json
  can't be parsed, the backup substitutes an empty object and warns to
  stderr instead of copying the raw file (which held primaryApiKey /
  oauthAccount). Verified the raw key never reaches the archive. (H2)
- Dropped-file paths typed into the terminal are now always single-quoted
  (with '\'' escaping), not only when they contain whitespace — a name
  like `foo$(whoami).txt` was previously sent raw into the shell. (M2)
- write_bedrock_static_credentials checks the exec exit code via the new
  exec_oneshot_env_status and fails loudly on a write/chmod error instead
  of silently reporting success. exec_oneshot keeps its
  ignore-exit-code behavior so list_container_files is unaffected. (M4)
- Backup removes a partial/truncated archive on any stream error and
  treats a non-zero tar exit code as failure (a truncated gzip was
  previously reported as success). (L1)
- Dropped files are capped at 256 MiB to avoid ballooning host RAM
  (the file is read fully into memory then re-tarred). (M3)
- Stopped excluding .git/objects from the backup so git history,
  including unpushed commits, is preserved faithfully. (L3)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/src-tauri/src/docker/container.rs

@@ -1163,10 +1163,17 @@ fi
 chmod 600 "$HOME/.aws/credentials""#;
 
     let cmd = vec!["sh".to_string(), "-c".to_string(), script.to_string()];
-    crate::docker::exec::exec_oneshot_env(container_id, cmd, env)
-        .await
-        .map(|_| ())
-        .map_err(|e| format!("Failed to write AWS credentials into container: {}", e))?;
+    let (output, exit_code) =
+        crate::docker::exec::exec_oneshot_env_status(container_id, cmd, env)
+            .await
+            .map_err(|e| format!("Failed to write AWS credentials into container: {}", e))?;
+    if exit_code != 0 {
+        return Err(format!(
+            "Writing AWS credentials into container failed (exit {}): {}",
+            exit_code,
+            output.trim()
+        ));
+    }
 
     log::info!("Wrote Bedrock static credentials into container {}", container_id);
     Ok(())