fix(admin-ui): backup download button hits API path, not SPA route

`BackupHistory.jsx` opened `/admin/backup/download/<id>` via window.open,
which goes to the React SPA's router — no matching route, so it
rendered the "Page Not Found" screen.

The actual download endpoint lives at `/api/admin/backup/download/:id`
on the backend (adminBackup.js:685). Cookie-based admin auth already
supports the implicit cookie sent by window.open, so the URL prefix
was the only thing missing.

Predates today's backup-hardening work — the bug has existed since
this download button shipped. Surfaced now because Ralf finally has a
completed backup to try downloading after the Stage A inline-dump
guard started working.

frontend/src/components/admin/BackupHistory.jsx

@@ -236,7 +236,7 @@ export const BackupHistory = () => {
                             </button>
                             {backup.manifest_path && (
                               <button
-                                onClick={() => window.open(`/admin/backup/download/${backup.id}`, '_blank')}
+                                onClick={() => window.open(`/api/admin/backup/download/${backup.id}`, '_blank')}
                                 className="text-neutral-400 hover:text-neutral-600 dark:hover:text-neutral-300"
                                 title={t('backup.actions.download')}
                               >