Download backup

apiserver/backup: api endpoint for downloading a backup
Can we please move all this business logic out of the ServeHTTP and into its own method. Like what's been done for /tools and /charms