Auto-prune and deleteInstallation bypass the _deleting per-row guard

[Zaldaryon]

PR #136 added a per-row _deleting flag to prevent double-dispatch when the user clicks the trash button twice. Two other code paths remove backup archives without checking this flag:

1. The auto-prune loop at backup.ts:117-126 removes excess archives on a timer.
2. deleteInstallation with the "delete data" option removes all backups for that installation.

Both can race with a user-initiated delete on the same row, producing the same false-failure toast #136 fixed for the button path. BackupRecord would need the field before the prune could even check it, so a broader design pass is needed.

[Zaldaryon]

Duplicate of #142. Same race between auto-prune/deleteInstallation and the per-row _deleting guard, described from a different angle.