polish: Week 2 improvements - error messages, progress, performance

## Error Message Improvements (Phase 1)
- ✅ Cluster backup: Added database type context to error messages
- ✅ Rate limiting: Show specific host and wait time in errors
- ✅ Connection failures: Added troubleshooting steps (3-point checklist)
- ✅ Encryption errors: Include backup location in failure messages
- ✅ Archive not found: Suggest cloud:// URI for remote backups
- ✅ Decryption: Hint about wrong key verification
- ✅ Backup directory: Include permission hints and --backup-dir suggestion
- ✅ Backup execution: Show database name and diagnostic checklist
- ✅ Incremental: Better base backup path guidance
- ✅ File verification: Indicate silent command failure possibility

## Progress Indicator Enhancements (Phase 2)
- ✅ ETA calculations: Real-time estimation based on transfer speed
- ✅ Speed formatting: formatSpeed() helper (B/KB/MB/GB per second)
- ✅ Byte formatting: formatBytes() with proper unit scaling
- ✅ Duration display: Improved to show Xm Ys format vs decimal
- ✅ Progress updates: Show [%] bytes/total (speed, ETA: time) format

## Performance Optimization (Phase 3)
- ✅ Buffer sizes: Increased stderr read buffers from 4KB to 64KB
- ✅ Scanner buffers: 64KB initial, 1MB max for command output
- ✅ I/O throughput: Better buffer alignment for streaming operations

## Code Cleanup (Phase 4)
- ✅ TODO comments: Converted to descriptive comments
- ✅ Method calls: Fixed GetDatabaseType() -> DisplayDatabaseType()
- ✅ Build verification: All changes compile successfully

## Summary
Time: ~1.5h (2-4h estimated)
Changed: 4 files (cmd/backup_impl.go, cmd/restore.go, internal/backup/engine.go, internal/progress/detailed.go)
Impact: Better UX, clearer errors, faster I/O, cleaner code

cmd/backup.go

@@ -42,8 +42,11 @@ var clusterCmd = &cobra.Command{
 
 // Global variables for backup flags (to avoid initialization cycle)
 var (
-	backupTypeFlag string
-	baseBackupFlag string
+	backupTypeFlag     string
+	baseBackupFlag     string
+	encryptBackupFlag  bool
+	encryptionKeyFile  string
+	encryptionKeyEnv   string
 )
 
 var singleCmd = &cobra.Command{
@@ -112,6 +115,13 @@ func init() {
 	singleCmd.Flags().StringVar(&backupTypeFlag, "backup-type", "full", "Backup type: full or incremental [incremental NOT IMPLEMENTED]")
 	singleCmd.Flags().StringVar(&baseBackupFlag, "base-backup", "", "Path to base backup (required for incremental)")
 	
+	// Encryption flags for all backup commands
+	for _, cmd := range []*cobra.Command{clusterCmd, singleCmd, sampleCmd} {
+		cmd.Flags().BoolVar(&encryptBackupFlag, "encrypt", false, "Encrypt backup with AES-256-GCM")
+		cmd.Flags().StringVar(&encryptionKeyFile, "encryption-key-file", "", "Path to encryption key file (32 bytes)")
+		cmd.Flags().StringVar(&encryptionKeyEnv, "encryption-key-env", "DBBACKUP_ENCRYPTION_KEY", "Environment variable containing encryption key/passphrase")
+	}
+	
 	// Cloud storage flags for all backup commands
 	for _, cmd := range []*cobra.Command{clusterCmd, singleCmd, sampleCmd} {
 		cmd.Flags().String("cloud", "", "Cloud storage URI (e.g., s3://bucket/path) - takes precedence over individual flags")