feat: include history in export/import backup

Export now returns version 2 with a history array alongside instances.
Import accepts the history array and restores all audit events. v1 backups
without a history key still import cleanly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/db.js

@@ -155,7 +155,7 @@ export function deleteInstance(vmid) {
   db.prepare('DELETE FROM instances WHERE vmid = ?').run(vmid);
 }
 
-export function importInstances(rows) {
+export function importInstances(rows, historyRows = []) {
   db.exec('BEGIN');
   db.exec('DELETE FROM instance_history');
   db.exec('DELETE FROM instances');
@@ -168,6 +168,12 @@ export function importInstances(rows) {
        @tailscale, @andromeda, @tailscale_ip, @hardware_acceleration)
   `);
   for (const row of rows) insert.run(row);
+  if (historyRows.length) {
+    const insertHist = db.prepare(
+      `INSERT INTO instance_history (vmid, field, old_value, new_value, changed_at) VALUES (?, ?, ?, ?, ?)`
+    );
+    for (const h of historyRows) insertHist.run(h.vmid, h.field, h.old_value ?? null, h.new_value ?? null, h.changed_at);
+  }
   db.exec('COMMIT');
 }
 
@@ -177,6 +183,10 @@ export function getInstanceHistory(vmid) {
   ).all(vmid);
 }
 
+export function getAllHistory() {
+  return db.prepare('SELECT * FROM instance_history ORDER BY vmid, changed_at').all();
+}
+
 // ── Test helpers ──────────────────────────────────────────────────────────────
 
 export function _resetForTest() {

server/routes.js

@@ -1,7 +1,7 @@
 import { Router } from 'express';
 import {
   getInstances, getInstance, getDistinctStacks,
-  createInstance, updateInstance, deleteInstance, importInstances, getInstanceHistory,
+  createInstance, updateInstance, deleteInstance, importInstances, getInstanceHistory, getAllHistory,
 } from './db.js';
 
 export const router = Router();
@@ -116,14 +116,15 @@ router.put('/instances/:vmid', (req, res) => {
 // GET /api/export
 router.get('/export', (_req, res) => {
   const instances = getInstances();
+  const history = getAllHistory();
   const date = new Date().toISOString().slice(0, 10);
   res.setHeader('Content-Disposition', `attachment; filename="catalyst-backup-${date}.json"`);
-  res.json({ version: 1, exported_at: new Date().toISOString(), instances });
+  res.json({ version: 2, exported_at: new Date().toISOString(), instances, history });
 });
 
 // POST /api/import
 router.post('/import', (req, res) => {
-  const { instances } = req.body ?? {};
+  const { instances, history = [] } = req.body ?? {};
   if (!Array.isArray(instances)) {
     return res.status(400).json({ error: 'body must contain an instances array' });
   }
@@ -134,7 +135,7 @@ router.post('/import', (req, res) => {
   }
   if (errors.length) return res.status(400).json({ errors });
   try {
-    importInstances(instances.map(normalise));
+    importInstances(instances.map(normalise), Array.isArray(history) ? history : []);
     res.json({ imported: instances.length });
   } catch (e) {
     console.error('POST /api/import', e);