Download backup

apiserver/backup: api endpoint for downloading a backup
I think you *do* want to have 1 bit of testing state that asserts that the testBackup function was called at all, both otherwise moving all the assertions inline in the function is just fine. (you just need the other check because otherwise the test still passes if we don't call backup.)