feat: complete backup (EQ rules, stats, sync) + backup password hygiene

1 + 3 from the roadmap:
- Backup/restore now also covers per-path EQ rules, the listening-statistics ring
  buffer (new GET/POST /playstats with Playstats ring accessors) and the Sync settings
  section (the restore section list previously omitted 'sync', so server/peer/branding
  sync config was silently dropped on restore).
- Password hygiene: sync/peer/MQTT/FTP passwords are only written into the export when
  the credentials checkbox is ticked (relabelled 'include passwords'); otherwise they
  are blanked so a shared backup doesn't leak secrets in cleartext.

Verified on the test device: set an EQ rule -> assemble a backup -> wipe -> UI import
from file restores it; /playstats round-trips (365-day ring, lastDay); no console errors.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: fhirschmann

README.md

@@ -104,6 +104,7 @@ neon logo that doubles as the SVG favicon ([`7be5254`](../../commit/7be5254)):
 | PWA support: web app manifest + app icon, "add to home screen" with proper icon and name | [`b4287b9`](../../commit/b4287b9) |
 | PWA offline fallback: a service worker serves a cyberpunk "ESPuino Offline" page (with auto-reconnect) instead of a black screen when the home-screen app is launched while the player is powered off | [`bd07a7c`](../../commit/bd07a7c) |
 | Full backup: export/import of all settings + RFID assignments as JSON, WiFi credentials optional | [`4c90ff4`](../../commit/4c90ff4) |
+| **Backup completeness + password hygiene**: the JSON backup/restore now also covers the **per-path EQ rules**, the **listening-statistics** ring buffer (new `GET`/`POST /playstats`) and the **Sync** settings section (which the restore previously skipped) — so a restore no longer silently drops them. Passwords (sync/peer/MQTT/FTP) are only included when the (renamed) **"include passwords"** checkbox is ticked, so a shared backup doesn't leak credentials in cleartext | [`backup-complete`](../../releases/tag/backup-complete) |
 | One-click OTA update: GitHub Actions publishes a rolling `latest` release (`firmware.bin`); a Tools-tab button makes the device pull that firmware from GitHub over HTTPS and flash it via OTA, then reboot. Also triggerable via the bindable command **186** (button/RFID modifier) and the MQTT command-topic `firmware_update` (`ON`/`update`); the state-topic reports `idle`/`updating`/`up_to_date`/`failed` | [`8527f5e`](../../commit/8527f5e) |
 | Equalizer profiles: dropdown presets (Flat / Music / Audiobook-Speech / Deep voices / Custom) on top of the 3-band tone control; speech presets cut bass and lift mids/highs so deep narrator voices stay intelligible, persisted in NVS. Profiles can also be assigned per file or directory (right-click in the file browser) — e.g. set the speech profile for all Bibi Blocksberg episodes at once; the RFID tab shows the active profile for the highlighted file (or "No EQ set"). The active profile can be cycled with the bindable command **154** (button/RFID modifier) and set/reported via the MQTT topic `equalizer` (`flat`/`music`/`speech`/`voiceBoost`) | [`11ade33`](../../commit/11ade33) |
 | Blinking "OK" indicator next to the battery replaces the generic "action successful" toast | [`f41bb72`](../../commit/f41bb72) |

html/locales/de.json

@@ -666,7 +666,7 @@
 			"desc": "Exportiert bzw. importiert alle Einstellungen und RFID-Zuweisungen als JSON-Datei.",
 			"export": {
 				"title": "Export",
-				"includeWifi": "WLAN-Zugangsdaten einschließen",
+				"includeWifi": "Passwörter einschließen (WLAN, Sync, Peers)",
 				"button": "Backup herunterladen"
 			},
 			"import": {

html/locales/en.json

@@ -666,7 +666,7 @@
 			"desc": "Exports or imports all settings and RFID assignments as a JSON file.",
 			"export": {
 				"title": "Export",
-				"includeWifi": "Include WiFi credentials",
+				"includeWifi": "Include passwords (WiFi, sync, peers)",
 				"button": "Download backup"
 			},
 			"import": {

html/locales/fr.json

@@ -655,7 +655,7 @@
 			"desc": "Exporte ou importe tous les réglages et attributions RFID dans un fichier JSON.",
 			"export": {
 				"title": "Export",
-				"includeWifi": "Inclure les identifiants WiFi",
+				"includeWifi": "Inclure les mots de passe (WiFi, sync, pairs)",
 				"button": "Télécharger la sauvegarde"
 			},
 			"import": {

html/management.html

@@ -6127,16 +6127,29 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 			return dDisplay + hDisplay + mDisplay;
 		}
 		async function exportBackup() {
+			const includeCreds = document.getElementById('backupIncludeWifi').checked;
 			const backup = {
 				espuinoBackup: 1,
 				created: new Date().toISOString(),
 				settings: await (await fetch("http://" + host + "/settings")).json(),
-				rfid: await (await fetch("http://" + host + "/rfid")).json()
+				rfid: await (await fetch("http://" + host + "/rfid")).json(),
+				eqRules: await (await fetch("http://" + host + "/eqrules")).json(),
+				playStats: await (await fetch("http://" + host + "/playstats")).json()
 			};
 			delete backup.settings.ssids; // names only - not usable for a restore
-			if (document.getElementById('backupIncludeWifi').checked) {
+			if (includeCreds) {
 				backup.wifiConfig = await (await fetch("http://" + host + "/wificonfig")).json();
 				backup.wifiNetworks = await (await fetch("http://" + host + "/savedSSIDs?credentials=1")).json();
+			} else {
+				// strip secrets so a shared backup doesn't leak passwords in cleartext
+				const s = backup.settings || {};
+				if (s.sync) {
+					s.sync.password = "";
+					s.sync.rfidPeerKey = "";
+					try { const peers = JSON.parse(s.sync.rfidPeers || "[]"); peers.forEach(p => { p.key = ""; }); s.sync.rfidPeers = JSON.stringify(peers); } catch (e) { }
+				}
+				if (s.mqtt && 'password' in s.mqtt) s.mqtt.password = "";
+				if (s.ftp && 'password' in s.ftp) s.ftp.password = "";
 			}
 			const blob = new Blob([JSON.stringify(backup, null, "\t")], {
 				type: "application/json"
@@ -6167,7 +6180,7 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 			}
 			let errors = 0;
 			// the firmware applies one settings section per request
-			const sections = ['general', 'equalizer', 'led', 'battery', 'playlist', 'buttons', 'rotary', 'ftp', 'mqtt', 'bluetooth'];
+			const sections = ['general', 'equalizer', 'led', 'battery', 'playlist', 'buttons', 'rotary', 'ftp', 'mqtt', 'bluetooth', 'sync'];
 			for (const section of sections) {
 				if (backup.settings && backup.settings[section]) {
 					const response = await fetch("http://" + host + "/settings", {
@@ -6201,6 +6214,30 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 					}
 				}
 			}
+			// restore per-path EQ rules
+			if (Array.isArray(backup.eqRules)) {
+				for (const r of backup.eqRules) {
+					if (!r || !r.p) {
+						continue;
+					}
+					const qs = "path=" + encodeURIComponent(r.p) + "&low=" + (r.l | 0) + "&band=" + (r.b | 0) + "&high=" + (r.h | 0) + "&profile=" + encodeURIComponent(r.pr || "");
+					const response = await fetch("http://" + host + "/eqrule?" + qs, { method: "POST" });
+					if (!response.ok) {
+						errors++;
+					}
+				}
+			}
+			// restore listening statistics (ring buffer)
+			if (backup.playStats && Array.isArray(backup.playStats.days)) {
+				const response = await fetch("http://" + host + "/playstats", {
+					method: "POST",
+					headers: { "Content-Type": "application/json" },
+					body: JSON.stringify(backup.playStats)
+				});
+				if (!response.ok) {
+					errors++;
+				}
+			}
 			if (Array.isArray(backup.wifiNetworks)) {
 				for (const network of backup.wifiNetworks) {
 					if (!network.ssid) {

src/Playstats.cpp

@@ -142,3 +142,24 @@ uint32_t Playstats_GetLastDays(uint16_t days) {
 	}
 	return sum;
 }
+
+uint16_t Playstats_GetRingSize(void) {
+	return PLAYSTATS_DAYS;
+}
+uint32_t Playstats_GetRingLastDay(void) {
+	return gLastDay;
+}
+uint32_t Playstats_GetRingSlot(uint16_t i) {
+	return (i < PLAYSTATS_DAYS) ? gDays[i] : 0;
+}
+void Playstats_RestoreRing(uint32_t lastDay, const uint32_t *slots, uint16_t count) {
+	if (count > PLAYSTATS_DAYS) {
+		count = PLAYSTATS_DAYS;
+	}
+	for (uint16_t i = 0; i < PLAYSTATS_DAYS; i++) {
+		gDays[i] = (i < count && slots) ? slots[i] : 0;
+	}
+	gLastDay = lastDay;
+	gDirty = true;
+	Playstats_Save();
+}

src/Playstats.h

@@ -14,3 +14,9 @@ void Playstats_Save(void); // flush the RAM buffer to NVS if dirty (periodic + o
 uint32_t Playstats_GetToday(void); // seconds listened today (local calendar day)
 uint32_t Playstats_GetYesterday(void); // seconds listened yesterday
 uint32_t Playstats_GetLastDays(uint16_t days); // sum over the last <days> calendar days (incl. today)
+
+// Raw ring-buffer access for backup/restore (JSON is built/parsed by the caller).
+uint16_t Playstats_GetRingSize(void); // number of day-slots (365)
+uint32_t Playstats_GetRingLastDay(void); // local day number of the most recent tracked day
+uint32_t Playstats_GetRingSlot(uint16_t i); // seconds in raw slot i (0..size-1)
+void Playstats_RestoreRing(uint32_t lastDay, const uint32_t *slots, uint16_t count); // restore from backup

src/Web.cpp

@@ -1027,6 +1027,34 @@ void webserverStart(void) {
 			request->send(response);
 		});
 
+		// Listening-stats ring buffer (for backup/restore). GET returns it, POST restores it.
+		wServer.on("/playstats", HTTP_GET, [](AsyncWebServerRequest *request) {
+			AsyncJsonResponse *response = new AsyncJsonResponse(false);
+			JsonObject o = response->getRoot();
+			o["lastDay"] = Playstats_GetRingLastDay();
+			JsonArray a = o["days"].to<JsonArray>();
+			const uint16_t n = Playstats_GetRingSize();
+			for (uint16_t i = 0; i < n; i++) {
+				a.add(Playstats_GetRingSlot(i));
+			}
+			response->setLength();
+			request->send(response);
+		});
+		wServer.addHandler(new AsyncCallbackJsonWebHandler("/playstats", [](AsyncWebServerRequest *request, JsonVariant &json) {
+			JsonObject o = json.as<JsonObject>();
+			static uint32_t buf[365];
+			uint16_t c = 0;
+			if (o["days"].is<JsonArray>()) {
+				for (JsonVariant v : o["days"].as<JsonArray>()) {
+					if (c < 365) {
+						buf[c++] = v.as<uint32_t>();
+					}
+				}
+			}
+			Playstats_RestoreRing(o["lastDay"].as<uint32_t>(), buf, c);
+			request->send(200, "text/plain; charset=utf-8", "ok");
+		}));
+
 		// WiFi scan
 		wServer.on("/wifiscan", HTTP_GET, handleWiFiScanRequest);