fix: always create legacy.env even when .env missing from legacy stack

steps/00-backup.sh

@@ -167,7 +167,30 @@ ok "UFW snapshot saved."
 # ─── BACKUP LEGACY ENV ────────────────────────────────────────────────────────
 sep
 info "Backing up legacy .env..."
-_save "$LEGACY_COMPOSE_DIR/.env" legacy.env
+LEGACY_API_TOKEN=""
+
+if [ -f "$LEGACY_COMPOSE_DIR/.env" ]; then
+    _save "$LEGACY_COMPOSE_DIR/.env" legacy.env
+    LEGACY_API_TOKEN=$(grep -E '^API_TOKEN=' "$BACKUP_DIR/legacy.env" 2>/dev/null \
+        | cut -d= -f2 | tr -d '[:space:]' || true)
+else
+    warn ".env not found in legacy stack — checking docker-compose.yml..."
+    LEGACY_API_TOKEN=$(grep -E 'API_TOKEN' "$LEGACY_COMPOSE_DIR/docker-compose.yml" 2>/dev/null \
+        | grep -oP '(?<==)[^\s"]+' | head -1 | tr -d '[:space:]' || true)
+fi
+
+# Always write legacy.env so env.sh never fails on missing file
+{
+    echo "# Generated by 00-backup.sh — $(date '+%Y-%m-%d %H:%M:%S')"
+    if [ -n "$LEGACY_API_TOKEN" ]; then
+        echo "API_TOKEN=${LEGACY_API_TOKEN}"
+        ok "API_TOKEN extracted from legacy stack"
+    else
+        echo "API_TOKEN="
+        warn "API_TOKEN not found in legacy — a new one will be generated"
+    fi
+} > "$BACKUP_DIR/legacy.env"
+chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/legacy.env"
 
 # ─── DETECT NETWORK ───────────────────────────────────────────────────────────
 sep