Backups push automatically; the token is only for restore

Matches the master's tokenless-push change: pushBackup no longer waits
for master_backup_token — every instance with a uuid backs up on its
own, and the 5-minute tick force-pushes so a poisoned master copy
self-heals. The token now only gates pulling a backup back (restore),
so setup-linux.sh asks for it only when restoring and the Settings
help text says so.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lib/db.ts

@@ -197,8 +197,9 @@ seedSetting.run('twocaptcha_api_key', '');
 // Blank falls back to the proxy hardcoded in app/api/autobuyer/captcha; `none`
 // solves without one.
 seedSetting.run('twocaptcha_proxy', '');
-// Bearer for pushing/pulling the encrypted settings+credentials backup on the
-// master (its INSTANCE_BACKUP_TOKEN). Blank = backups off.
+// Bearer for PULLING an encrypted settings+credentials backup back from the
+// master (its INSTANCE_BACKUP_TOKEN) — pushing needs no token and happens
+// automatically. Blank = restore unavailable from this machine's UI.
 seedSetting.run('master_backup_token', '');
 // Routes broker traffic (TopstepX, Tradovate, Yahoo quotes) through a proxy:
 // http(s):// or socks5(h)://, user:pass ok. The master link stays direct on