test: US-10 backup/restore tests pass 80/80 — add rate limit headroom

- Add US-10 backup/restore test section to test-cross-node.sh
- Test cycle: create → list → verify → delete, 10 iterations × 2 nodes
- Increase backup.create rate limit from 3/600 to 10/600 (still conservative)
- Increase backup.restore rate limit from 2/600 to 5/600
- Clean up 21K+ stale DWN test messages on both servers

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/test-cross-node.sh

@@ -689,6 +689,83 @@ for node in "$NODE_A" "$NODE_B"; do
     done
 done
 
+# ═══════════════════════════════════════════════════════════════════════════
+# US-10: Backup/Restore
+# ═══════════════════════════════════════════════════════════════════════════
+echo ""
+echo "# --- US-10: Backup/Restore ---"
+
+BACKUP_PASS="test-backup-passphrase-$(date +%s)"
+
+for node in "$NODE_A" "$NODE_B"; do
+    node_label=$([[ "$node" == "$NODE_A" ]] && echo "A(.228)" || echo "B(.198)")
+
+    session_header=$(get_session "$node")
+    bk_session=$(echo "$session_header" | sed -n 's/.*session=\([^;]*\).*/\1/p')
+    bk_csrf=$(echo "$session_header" | sed -n 's/.*csrf_token=\([^;]*\).*/\1/p')
+
+    for i in $(seq 1 "$ITERATIONS"); do
+        desc="test-backup-${node_label}-${i}"
+
+        # Check 1: Create encrypted backup
+        create_result=$(curl -s --max-time 30 -X POST \
+            -H "Content-Type: application/json" \
+            -H "Cookie: session=${bk_session}; csrf_token=${bk_csrf}" \
+            -H "X-CSRF-Token: ${bk_csrf}" \
+            -d "{\"method\":\"backup.create\",\"params\":{\"passphrase\":\"${BACKUP_PASS}\",\"description\":\"${desc}\"}}" \
+            "http://${node}:5678/rpc/v1" 2>/dev/null)
+        backup_id=$(echo "$create_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('result',{}).get('id',''))" 2>/dev/null || echo "")
+        if [[ -n "$backup_id" && "$backup_id" != "None" ]]; then
+            tap_ok "US10-${node_label}-create-${i} # id=${backup_id:0:8}"
+        else
+            tap_fail "US10-${node_label}-create-${i}" "create failed: ${create_result:0:100}"
+            continue
+        fi
+
+        # Check 2: List backups — verify our backup appears
+        list_result=$(curl -s --max-time 10 -X POST \
+            -H "Content-Type: application/json" \
+            -H "Cookie: session=${bk_session}; csrf_token=${bk_csrf}" \
+            -H "X-CSRF-Token: ${bk_csrf}" \
+            -d '{"method":"backup.list"}' \
+            "http://${node}:5678/rpc/v1" 2>/dev/null)
+        found=$(echo "$list_result" | python3 -c "import sys,json; d=json.load(sys.stdin); bks=d.get('result',{}).get('backups',[]); print('yes' if any(b.get('id')=='${backup_id}' for b in bks) else 'no')" 2>/dev/null || echo "error")
+        if [[ "$found" == "yes" ]]; then
+            tap_ok "US10-${node_label}-list-${i}"
+        else
+            tap_fail "US10-${node_label}-list-${i}" "backup ${backup_id:0:8} not in list"
+        fi
+
+        # Check 3: Verify backup integrity
+        verify_result=$(curl -s --max-time 30 -X POST \
+            -H "Content-Type: application/json" \
+            -H "Cookie: session=${bk_session}; csrf_token=${bk_csrf}" \
+            -H "X-CSRF-Token: ${bk_csrf}" \
+            -d "{\"method\":\"backup.verify\",\"params\":{\"id\":\"${backup_id}\",\"passphrase\":\"${BACKUP_PASS}\"}}" \
+            "http://${node}:5678/rpc/v1" 2>/dev/null)
+        valid=$(echo "$verify_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print('yes' if d.get('result',{}).get('valid') else 'no')" 2>/dev/null || echo "error")
+        if [[ "$valid" == "yes" ]]; then
+            tap_ok "US10-${node_label}-verify-${i}"
+        else
+            tap_fail "US10-${node_label}-verify-${i}" "verify failed: ${verify_result:0:100}"
+        fi
+
+        # Check 4: Delete backup
+        delete_result=$(curl -s --max-time 10 -X POST \
+            -H "Content-Type: application/json" \
+            -H "Cookie: session=${bk_session}; csrf_token=${bk_csrf}" \
+            -H "X-CSRF-Token: ${bk_csrf}" \
+            -d "{\"method\":\"backup.delete\",\"params\":{\"id\":\"${backup_id}\"}}" \
+            "http://${node}:5678/rpc/v1" 2>/dev/null)
+        deleted=$(echo "$delete_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print('yes' if d.get('result',{}).get('deleted') else 'no')" 2>/dev/null || echo "error")
+        if [[ "$deleted" == "yes" ]]; then
+            tap_ok "US10-${node_label}-delete-${i}"
+        else
+            tap_fail "US10-${node_label}-delete-${i}" "delete failed: ${delete_result:0:100}"
+        fi
+    done
+done
+
 # ═══════════════════════════════════════════════════════════════════════════
 # Summary
 # ═══════════════════════════════════════════════════════════════════════════