security: Implement HIGH priority security improvements

HIGH Priority Security Features:
- Path sanitization with filepath.Clean() for all user paths
- Path traversal attack prevention in backup/restore operations
- Secure config file permissions (0600 instead of 0644)
- SHA-256 checksum generation for all backup archives
- Checksum verification during restore operations
- Comprehensive audit logging for compliance

New Security Module (internal/security/):
- paths.go: ValidateBackupPath() and ValidateArchivePath()
- checksum.go: ChecksumFile(), VerifyChecksum(), LoadAndVerifyChecksum()
- audit.go: AuditLogger with structured event tracking

Integration Points:
- Backup engine: Path validation, checksum generation
- Restore engine: Path validation, checksum verification
- All backup/restore operations: Audit logging
- Configuration saves: Audit logging

Security Enhancements:
- .dbbackup.conf now created with 0600 permissions (owner-only)
- All archive files get .sha256 checksum files
- Restore warns if checksum verification fails but continues
- Audit events logged for all administrative operations
- User tracking via $USER/$USERNAME environment variables

Compliance Features:
- Audit trail for backups, restores, config changes
- Structured logging with timestamps, users, actions, results
- Event details include paths, sizes, durations, errors

Testing:
- All code compiles successfully
- Cross-platform build verified
- Ready for integration testing

cmd/restore.go

@@ -12,6 +12,7 @@ import (
 
 	"dbbackup/internal/database"
 	"dbbackup/internal/restore"
+	"dbbackup/internal/security"
 
 	"github.com/spf13/cobra"
 )
@@ -272,10 +273,19 @@ func runRestoreSingle(cmd *cobra.Command, args []string) error {
 
 	// Execute restore
 	log.Info("Starting restore...", "database", targetDB)
+	
+	// Audit log: restore start
+	user := security.GetCurrentUser()
+	startTime := time.Now()
+	auditLogger.LogRestoreStart(user, targetDB, archivePath)
 
 	if err := engine.RestoreSingle(ctx, archivePath, targetDB, restoreClean, restoreCreate); err != nil {
+		auditLogger.LogRestoreFailed(user, targetDB, err)
 		return fmt.Errorf("restore failed: %w", err)
 	}
+	
+	// Audit log: restore success
+	auditLogger.LogRestoreComplete(user, targetDB, time.Since(startTime))
 
 	log.Info("✅ Restore completed successfully", "database", targetDB)
 	return nil
@@ -368,10 +378,19 @@ func runRestoreCluster(cmd *cobra.Command, args []string) error {
 
 	// Execute cluster restore
 	log.Info("Starting cluster restore...")
+	
+	// Audit log: restore start
+	user := security.GetCurrentUser()
+	startTime := time.Now()
+	auditLogger.LogRestoreStart(user, "all_databases", archivePath)
 
 	if err := engine.RestoreCluster(ctx, archivePath); err != nil {
+		auditLogger.LogRestoreFailed(user, "all_databases", err)
 		return fmt.Errorf("cluster restore failed: %w", err)
 	}
+	
+	// Audit log: restore success
+	auditLogger.LogRestoreComplete(user, "all_databases", time.Since(startTime))
 
 	log.Info("✅ Cluster restore completed successfully")
 	return nil