Best practice for backing up /data/media? Currently, TWRP backups don't include /data/media, and this doesn't appear to be on the developers' radar at all (the issue for it over at GitHub is just a bunch of +1s with no official response). Now that we have SELinux to contend with, simply copying the files back and forth is apparently no longer an option, and there are a number of different ways to access /data/media throughout the filesystem, each with different effective owners and permissions.

In excruciating detail, how should I approach backing up and restoring /data/media so everything is restored exactly as it was and my apps don't have trouble with the resulting permissions?
I recommend directly copying files from/to /sdcard.
The sdcard service will handle all the permissions and SELinux contexts for you.
The /storage/emulated/0, /mnt/shell/emulated/0 and /storage/emulated/legacy are all shadow reflexes of /data/media (typically /data/media/0). In the /init.rc file you can find out that the /system/bin/sdcard is a service that controls all of them, so you can just copy the files in /storage/emulated/0 with ease. All other directories like /sdcard and /storage/sdcard0 are symbolic links. They don't matter at all.