fix(webclipper): exclude Obsidian API key from backups

[chiimagnus]

Summary

• exclude obsidian_api_key from chrome.storage.local backup exports
• keep non-sensitive Obsidian settings such as obsidian_api_base_url in backups
• update smoke/domain backup utility tests to cover the secret exclusion

Testing

• Not run locally; changes are covered by existing Vitest backup utility tests updated in this PR.