Add TLA+ formal verification specs for backup and recovery

- backup.tla: models backup/restore/verify/cleanup with properties:
  BackupSnapshotsValid, RestoreIntegrity, VerifyIntegrity,
  RetentionInvariant, HistoryConsistency, BackupIdValid
- recovery.tla: models WAL replay REDO/UNDO with properties:
  RedoCommitted, RecoveryCompleteness, WalIntegrity
- Added models/backup.cfg and models/recovery.cfg with bounded constants
- Updated run_all.sh to include both new specs
- All 9 TLA+ specs pass TLC model checking

formal-verification/models/backup.cfg

@@ -0,0 +1,20 @@
+CONSTANTS
+  Files = {f1, f2}
+  Contents = {c1, c2}
+  MaxBackups = 3
+  KeepCount = 2
+  MaxSteps = 6
+  Nil = Nil
+
+INIT Init
+NEXT Next
+
+CHECK_DEADLOCK FALSE
+
+INVARIANTS
+  TypeOk
+  BackupSnapshotsValid
+  VerifyIntegrity
+  RetentionInvariant
+  HistoryConsistency
+  BackupIdValid