back up configuration.nix to .nina-bak before editing — single sudo sh -c does cp backup then cp new content (one password prompt, positional args avoid quoting); setupNixosWrote notes the backup path

@@ -1141,7 +1141,12 @@11411141     };11421142     tmp.close(io);11431143 1144-    const code = streamLocal(io, &.{ "sudo", "cp", tmp_path, path }) catch {1144+    // Back up the existing config, then replace it — in one sudo call so the1145+    // password is asked for at most once. Paths travel as positional args ($0,1146+    // $1) to sidestep shell quoting.1147+    const code = streamLocal(io, &.{1148+        "sudo", "sh", "-c", "cp -- \"$0\" \"$0.nina-bak\" && cp -- \"$1\" \"$0\"", path, tmp_path,1149+    }) catch {11451150         std.Io.Dir.deleteFile(.cwd(), io, tmp_path) catch {};11461151         errors.error_info.setMessage("could not write {s}", .{path});11471152         return error.ProcessFailed;

@@ -890,7 +890,7 @@890890 }891891 892892 pub fn setupNixosWrote(conf_path: []const u8) void {893-    p("{s}added the line to {s}\n", .{ step(), conf_path });893+    p("{s}added the line to {s}  {s}(backup: {s}.nina-bak){s}\n", .{ step(), conf_path, c(DIM), conf_path, c(RESET) });894894     p("{s}now run {s}sudo nixos-rebuild switch{s} — then nina's ready\n", .{ hdr(), c(BOLD), c(RESET) });895895 }896896