v1.1: harden recovery and control boundaries

WP-D and WP-E complete the planned v1.1 implementation packages.

WP-D — recovery honesty:
- backups verify the completed copy with PRAGMA integrity_check
- corruption missed by quick_check is detected by the full check
- existing good backups remain protected
- oversized exports are still delivered but declare whether this version can
  import them, while the 20 MB import limit remains unchanged
- backup was exercised through the real browser UI on both the normal campaign
  database and a campaign-shaped database over 100 MB

WP-E — control-boundary contrast:
- interactive control boundaries meet the WCAG 1.4.11 3:1 target
- the contrast audit is now a failing gate rather than an advisory
- rendered browser measurements pass for the composer, controls, tabs and nav
- text contrast and focus visibility remain intact
- owner reviewed and approved the before/after screenshots

Reports:
- planning/reports/v1.1/V1.1-WP-D-REPORT.md
- planning/reports/v1.1/V1.1-WP-E-REPORT.md

All planned v1.1 work packages A-E are now complete. Release validation has not
yet begun.

DEVELOPMENT.md

@@ -548,6 +548,40 @@ together.
 | Taken from | Export, on a campaign | Settings → *Back up everything on this machine* |
 | Restored by | Import campaign, on the library screen | replacing the database file, below |
 
+### How large an export can get
+
+The importer accepts a request body up to **20 MB**
+(`backend/app/limits.py`, `MAX_IMPORT_BODY_BYTES`), and v1.1 does not change it.
+What that means for a campaign, measured rather than guessed:
+
+- the M11 evidence campaign came to roughly **13 kB per action** in its bundle;
+- M9's conservative estimate from that figure is about **279 turns** before a
+  bundle approaches the limit.
+
+Both are measurements of particular campaigns, **not a turn limit**. What a
+campaign actually weighs depends on how long its turns are, how much imported
+knowledge travels with it, and how many attempts each turn kept. A campaign of
+400 short turns can be well inside the limit; one of 200 long ones with a large
+library may not be.
+
+**v1.1 (WP-D) makes the individual case visible.** Every export reports its own
+serialised size and whether this version could import it back:
+
+```text
+X-Export-Bytes                  the bundle's size, as the importer would weigh it
+X-Import-Limit-Bytes            MAX_IMPORT_BODY_BYTES
+X-Importable-By-This-Version    true / false
+X-Export-Warning                present only when it is false
+```
+
+The export always succeeds and the file is always delivered — it is complete and
+undamaged; what it exceeds is this version's import ceiling. Both Export
+controls show the warning when there is one. The size compared is the compact
+serialisation the browser would POST back, which is smaller than the
+pretty-printed file on disk.
+
+Raising the limit, or streaming an import past it, is deferred to v1.2.
+
 ### Exporting and importing a campaign
 
 Export is on each campaign in the library, and in the campaign's own Settings