security: Implement MEDIUM priority security improvements

MEDIUM Priority Security Features:
- Backup retention policy with automatic cleanup
- Connection rate limiting with exponential backoff
- Privilege level checks (warn if running as root)
- System resource limit awareness (ulimit checks)

New Security Modules (internal/security/):
- retention.go: Automated backup cleanup based on age and count
- ratelimit.go: Connection attempt tracking with exponential backoff
- privileges.go: Root/Administrator detection and warnings
- resources.go: System resource limit checking (file descriptors, memory)

Retention Policy Features:
- Configurable retention period in days (--retention-days)
- Minimum backup count protection (--min-backups)
- Automatic cleanup after successful backups
- Removes old archives with .sha256 and .meta files
- Reports freed disk space

Rate Limiting Features:
- Per-host connection tracking
- Exponential backoff: 1s, 2s, 4s, 8s, 16s, 32s, max 60s
- Automatic reset after successful connections
- Configurable max retry attempts (--max-retries)
- Prevents brute force connection attempts

Privilege Checks:
- Detects root/Administrator execution
- Warns with security recommendations
- Requires --allow-root flag to proceed
- Suggests dedicated backup user creation
- Platform-specific recommendations (Unix/Windows)

Resource Awareness:
- Checks file descriptor limits (ulimit -n)
- Monitors available memory
- Validates resources before backup operations
- Provides recommendations for limit increases
- Cross-platform support (Linux, BSD, macOS, Windows)

Configuration Integration:
- All features configurable via flags and .dbbackup.conf
- Security section in config file
- Environment variable support
- Persistent settings across sessions

Integration Points:
- All backup operations (cluster, single, sample)
- Automatic cleanup after successful backups
- Rate limiting on all database connections
- Privilege checks before operations
- Resource validation for large backups

Default Values:
- Retention: 30 days, minimum 5 backups
- Max retries: 3 attempts
- Allow root: disabled
- Resource checks: enabled

Security Benefits:
- Prevents disk space exhaustion from old backups
- Protects against connection brute force attacks
- Encourages proper privilege separation
- Avoids resource exhaustion failures
- Compliance-ready audit trail

Testing:
- All code compiles successfully
- Cross-platform compatibility maintained
- Ready for production deployment

internal/config/config.go

@@ -68,6 +68,13 @@ type Config struct {
 	SwapFilePath   string // Path to temporary swap file
 	SwapFileSizeGB int    // Size in GB (0 = disabled)
 	AutoSwap       bool   // Automatically manage swap for large backups
+
+	// Security options (MEDIUM priority)
+	RetentionDays  int  // Backup retention in days (0 = disabled)
+	MinBackups     int  // Minimum backups to keep regardless of age
+	MaxRetries     int  // Maximum connection retry attempts
+	AllowRoot      bool // Allow running as root/Administrator
+	CheckResources bool // Check resource limits before operations
 }
 
 // New creates a new configuration with default values
@@ -158,6 +165,13 @@ func New() *Config {
 		SwapFilePath:   getEnvString("SWAP_FILE_PATH", "/tmp/dbbackup_swap"),
 		SwapFileSizeGB: getEnvInt("SWAP_FILE_SIZE_GB", 0), // 0 = disabled by default
 		AutoSwap:       getEnvBool("AUTO_SWAP", false),
+
+		// Security defaults (MEDIUM priority)
+		RetentionDays:  getEnvInt("RETENTION_DAYS", 30),        // Keep backups for 30 days
+		MinBackups:     getEnvInt("MIN_BACKUPS", 5),            // Keep at least 5 backups
+		MaxRetries:     getEnvInt("MAX_RETRIES", 3),            // Maximum 3 retry attempts
+		AllowRoot:      getEnvBool("ALLOW_ROOT", false),        // Disallow root by default
+		CheckResources: getEnvBool("CHECK_RESOURCES", true),    // Check resources by default
 	}
 
 	// Ensure canonical defaults are enforced