feat(backup): sealed backups + printable recovery sheet

'Save a backup' now writes a sealed .tanemaki file (AES-256-GCM under a
key HKDF-derived from the root seed; format TANEBK v1, open and stable).
Restoring on the same identity is silent; a copy sealed by another
identity asks for the printed recovery code (TANE1 base32, typo-tolerant)
and adopts that seed — recovering your bank recovers you. Legacy plain
exports still restore. Settings gains a recovery sheet (QR + code PDF).
BackupBox/RecoveryCode live in commons_core, pure Dart, TDD.

apps/app_seeds/lib/di/injector.dart

@@ -22,6 +22,7 @@ import '../services/ocr/label_text_extractor.dart';
 import '../services/ocr/ocr_language.dart';
 import '../services/ocr/tesseract_label_extractor.dart';
 import '../services/onboarding_store.dart';
+import '../services/recovery_sheet_service.dart';
 import '../services/share_catalog_service.dart';
 
 /// The app's service locator. Kept to the composition root — widgets get their
@@ -75,10 +76,17 @@ Future<void> configureDependencies() async {
     ..registerSingleton<LabelTextExtractor>(labelExtractor)
     ..registerSingleton<OnboardingStore>(OnboardingStore(secretStore))
     ..registerSingleton<ExportImportService>(
-      ExportImportService(repository: varietyRepository, files: fileService),
+      ExportImportService(
+        repository: varietyRepository,
+        files: fileService,
+        keys: keyStore,
+      ),
     )
     ..registerSingleton<ShareCatalogService>(
       ShareCatalogService(files: fileService),
+    )
+    ..registerSingleton<RecoverySheetService>(
+      RecoverySheetService(files: fileService),
     );
 }