DriveBackupStorage
BackupStorage over Google Drive's appDataFolder — a hidden, per-account folder that syncs across the user's devices and is invisible in the Drive UI. Right for the large (~500 KB) encrypted dust-state blob that exceeds Block Store's 4 KB/entry cap.
The blob is already AES-256-GCM encrypted before it reaches here (Drive is pure transport — Google sees only ciphertext). REST calls go over plain HttpURLConnection with a Bearer token, mirroring ProvingKeyManager's download path, so no heavy google-api-services-drive client (and its transitive httpclient/guava conflicts) is pulled in.
Parameters
the single file we keep in appDataFolder (overwritten on each store)
yields a valid drive.appdata access token; called again (with forceRefresh=true) once on a 401 so an expired token is transparently renewed.