Harden strategy SoT: fail-closed funds gate, shared open pipeline, LIVE switch guards.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/api/backup_routes.py

@@ -83,10 +83,17 @@ async def download_backup(
         raise HTTPException(status_code=400, detail=str(e)) from e
     except FileNotFoundError as e:
         raise HTTPException(status_code=404, detail=str(e)) from e
+    from starlette.background import BackgroundTask
+
+    from ..backup import materialize_download_zip
+
+    # 下载包剥离 .env，机内完整备份仍保留供恢复
+    safe = materialize_download_zip(path)
     return FileResponse(
-        path,
+        safe,
         media_type="application/zip",
-        filename=path.name,
+        filename=path.name.replace(".zip", "_noenv.zip"),
+        background=BackgroundTask(lambda: safe.unlink(missing_ok=True)),
     )