feat: add PDS backup service with rclone + S3

Three backup types: pre-update (Watchtower lifecycle hook),
pre-deploy (Ansible task), and periodic (systemd timer).
All uploads go to OVH S3 via rclone. Backs up SQLite DBs,
pds.env, and Caddy config.

👾 Generated with [Letta Code](https://letta.com)

Co-Authored-By: Letta Code <noreply@letta.com>

.gitea/workflows/deploy.yml

@@ -42,6 +42,8 @@ jobs:
           pds_admin_email: ${{ vars.PDS_ADMIN_EMAIL }}
           pds_blobstore_s3_access_key: ${{ secrets.OVH_S3_ACCESS_KEY }}
           pds_blobstore_s3_secret_key: ${{ secrets.OVH_S3_SECRET_KEY }}
+          pds_backup_s3_access_key: ${{ secrets.OVH_S3_ACCESS_KEY }}
+          pds_backup_s3_secret_key: ${{ secrets.OVH_S3_SECRET_KEY }}
           EOF
 
       - name: Run playbook