feat(backend): add content-addressed gzip blob store (D-012)

Two on-disk pools per D-012:
- `MIMIC_BLOB_ROOT` (default `/var/lib/mimic/blobs/`) holds C2 polling
  output blobs, content-addressed gzip layout `<aa>/<bb>/<sha256>.gz`.
- `MIMIC_EVIDENCE_ROOT` (default `/var/lib/mimic/evidence/`) reserved for
  user-uploaded evidence (flat per-engagement, no compression). Wired only
  in config + .env.example here; F8 endpoint lands later.

`mimic.storage.blob`:
- `blob_path(root, sha256_hex)` validates the digest and returns the CAS
  path. Raises ValueError on a malformed digest (length != 64 or non-hex).
- `store_blob(root, data)` hashes, gzip-compresses, atomically writes to
  `<aa>/<bb>/<sha256>.gz` (0o750 dir perms, 0o640 file perms). Idempotent:
  duplicate writes leave mtime untouched.

5 new unit tests cover happy path, deduplication, idempotency, malformed
digest, and the two-byte-pair directory layout.

backend/.env.example

@@ -21,3 +21,7 @@ MIMIC_CORS_ORIGINS=http://localhost:5173
 # Logging
 MIMIC_LOG_LEVEL=DEBUG
 MIMIC_LOG_JSON=false
+
+# Storage pools (D-012)
+MIMIC_BLOB_ROOT=/var/lib/mimic/blobs
+MIMIC_EVIDENCE_ROOT=/var/lib/mimic/evidence