refactor: add backend support + cancellation and batched PBS query

[LDeakin]

This is a stripped down version of the simple-server branch, retaining the backend support and only LocalBackend.

LLM found a few issues and I think it is much better to put the actual job tracking in the prefect worker + persistent prefect variables rather than an independent process.

Since the move to the `wex2-orchestration` persistent session,
the Prefect worker and `pbspy-server` are neighbours on the same host — the same host that
already has `qsub`/`qstat`/`qdel` on `PATH` and `/g/data` mounted locally. They talk to each
other over loopback (`127.0.0.1:9876`) using length-prefixed **pickle** frames and a shared
secret. The indirection buys nothing and costs plenty:

- **Security:** `recv_frame` calls `pickle.loads` on socket bytes *before* the API key is
  checked (`pbspy/src/pbspy/server/server.py:129`), so anyone who can reach the port has RCE
  regardless of the key. The key itself is a single global plaintext string compared with `!=`.
- **Fragility:** the server holds all job state in memory
  (`pbspy/src/pbspy/server/server.py:13`). A `supervisorctl restart pbspy-server` drops every
  wait subscription and every blocked `job.result()` raises. A `WaitRequest` for a job the
  server didn't itself submit blocks the client **forever** (no timeout).
- **No resumability:** the flow-run-local registry `_job_ids_by_run`
  (`wex2_automation/utils/gadi_pbs.py:23`) dies with the subprocess. After a restart the PBS
  job keeps running, the flow fails, the retry sees no output yet, and **resubmits a duplicate
  job**. Nothing ever reconciles against `qstat`.

---

Added

• Add the public Backend interface and default LocalBackend implementation
  • JobDescription.submit() accepts a backend supplied by the caller
  • Each Job retains its backend for waiting, result retrieval, and cancellation
• Add Job.cancel()
• Add batched PBS state-query and deletion helpers

Changed

• Group Job.wait_all() and Job.result_all() calls by backend so each backend can wait for its jobs together
• Reuse a shared LocalBackend for jobs submitted without an explicit backend
• Return None when PBS has not reported a completed job's exit status

Fixed

• Preserve JobDescription.output_path and error_path on submitted jobs and use them when retrieving results
• Treat cancellation of finished or unknown PBS jobs as successful