Add TLA+ formal verification specs for backup and recovery

- backup.tla: models backup/restore/verify/cleanup with properties:
  BackupSnapshotsValid, RestoreIntegrity, VerifyIntegrity,
  RetentionInvariant, HistoryConsistency, BackupIdValid
- recovery.tla: models WAL replay REDO/UNDO with properties:
  RedoCommitted, RecoveryCompleteness, WalIntegrity
- Added models/backup.cfg and models/recovery.cfg with bounded constants
- Updated run_all.sh to include both new specs
- All 9 TLA+ specs pass TLC model checking

formal-verification/models/recovery.cfg

@@ -0,0 +1,18 @@
+CONSTANTS
+  Keys = {k1, k2}
+  Values = {v1, v2}
+  MaxTxnId = 2
+  MaxWalLen = 6
+  MaxSteps = 5
+  Nil = Nil
+
+INIT Init
+NEXT Next
+
+CHECK_DEADLOCK FALSE
+
+INVARIANTS
+  TypeOk
+  RedoCommitted
+  RecoveryCompleteness
+  WalIntegrity