* fix: harden ZIP backup extraction * fix: tune backup ZIP limits * refactor: simplify ZIP extraction validation