feat: include history in export/import backup

Export now returns version 2 with a history array alongside instances.
Import accepts the history array and restores all audit events. v1 backups
without a history key still import cleanly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/routes.js

@@ -1,7 +1,7 @@
 import { Router } from 'express';
 import {
   getInstances, getInstance, getDistinctStacks,
-  createInstance, updateInstance, deleteInstance, importInstances, getInstanceHistory,
+  createInstance, updateInstance, deleteInstance, importInstances, getInstanceHistory, getAllHistory,
 } from './db.js';
 
 export const router = Router();
@@ -116,14 +116,15 @@ router.put('/instances/:vmid', (req, res) => {
 // GET /api/export
 router.get('/export', (_req, res) => {
   const instances = getInstances();
+  const history = getAllHistory();
   const date = new Date().toISOString().slice(0, 10);
   res.setHeader('Content-Disposition', `attachment; filename="catalyst-backup-${date}.json"`);
-  res.json({ version: 1, exported_at: new Date().toISOString(), instances });
+  res.json({ version: 2, exported_at: new Date().toISOString(), instances, history });
 });
 
 // POST /api/import
 router.post('/import', (req, res) => {
-  const { instances } = req.body ?? {};
+  const { instances, history = [] } = req.body ?? {};
   if (!Array.isArray(instances)) {
     return res.status(400).json({ error: 'body must contain an instances array' });
   }
@@ -134,7 +135,7 @@ router.post('/import', (req, res) => {
   }
   if (errors.length) return res.status(400).json({ errors });
   try {
-    importInstances(instances.map(normalise));
+    importInstances(instances.map(normalise), Array.isArray(history) ? history : []);
     res.json({ imported: instances.length });
   } catch (e) {
     console.error('POST /api/import', e);