feat(04-01): implement BackupResponder with extracted CollectAndPublish

- Create BackupResponder for NATS request-reply on config.backup.trigger
- Extract public CollectAndPublish from BackupScheduler returning sha256 hash
- Define BackupExecutor/BackupLocker/DeviceGetter interfaces for testability
- Create RedisBackupLocker adapter wrapping redislock.Client
- Wire BackupResponder into main.go lifecycle
- All 6 tests pass with in-process NATS server

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

poller/cmd/poller/main.go

@@ -294,6 +294,23 @@ func main() {
 		cfg.ConfigBackupMaxConcurrent,
 	)
 
+	// -----------------------------------------------------------------------
+	// Initialize NATS backup responder for manual config backup triggers
+	// -----------------------------------------------------------------------
+	backupResponder := bus.NewBackupResponder(
+		publisher.Conn(),
+		deviceStore,
+		backupScheduler,
+		bus.NewRedisBackupLocker(locker),
+		backupCmdTimeout,
+	)
+	if err := backupResponder.Subscribe(); err != nil {
+		slog.Error("failed to start backup responder", "error", err)
+		os.Exit(1)
+	}
+	defer backupResponder.Stop()
+	slog.Info("NATS backup responder started (config.backup.trigger)")
+
 	go func() {
 		slog.Info("starting config backup scheduler",
 			"interval", backupInterval,