[Epic] Phase 3 — data services, configuration and backups

Parent

#132

Outcome

Treat databases, caches, environment variables, secrets, persistent volumes, and backups as first-class resources with clear ownership, provider capabilities, safe credentials, retention policies, and verified restore paths.

Product scope

• Provider-aware lifecycle management for supported relational, document, cache, and embedded database engines.
• Scoped config/secrets with drift previews and redaction.
• S3-compatible backup destinations, schedules, retention, encryption, restore verification, and volume coverage.
• Mount/volume visibility and explicit destructive-data protections.

Existing work incorporated

• #116

Children

• #156
• #157
• #158
• #159

Exit criteria

Every stateful service exposes a documented backup and recovery story, credentials never leak into UI/logs, and unsupported provider operations are clearly disabled with an explanation.

Completed. Every child and incorporated storage issue is closed. Data services, scoped encrypted configuration/secrets, S3-compatible destinations, durable backup/restore verification, persistent volumes, retention, destructive-data guards, and capability-aware provider UX are implemented and documented. Verification: full repository suite 2,888 passed / 0 failed, including data-service, backup/recovery, custom S3 endpoint, secrets, volume, and dashboard integration paths; strict typecheck, Pickier, and all workspace builds pass.