Download backup

apiserver/backup: api endpoint for downloading a backup
I certainly agree that moving the actual business logic out of here, and only handling HTTP level operations is a good way to do it.