feat: add PDS backup service with rclone + S3

Three backup types: pre-update (Watchtower lifecycle hook),
pre-deploy (Ansible task), and periodic (systemd timer).
All uploads go to OVH S3 via rclone. Backs up SQLite DBs,
pds.env, and Caddy config.

👾 Generated with [Letta Code](https://letta.com)

Co-Authored-By: Letta Code <noreply@letta.com>

playbook.yml

@@ -10,6 +10,12 @@
     pds_blob_upload_limit: 104857600
     pds_rate_limits_enabled: true
     pds_invite_required: true
+    pds_backup_period: 24h
+    pds_backup_s3_bucket: atprotopds-backup
+    pds_backup_s3_region: bhs
+    pds_backup_s3_endpoint: https://s3.bhs.io.cloud.ovh.net
+    pds_backup_s3_access_key: "{{ pds_blobstore_s3_access_key }}"
+    pds_backup_s3_secret_key: "{{ pds_blobstore_s3_secret_key }}"
 
   tasks:
     - name: Run PDS installer (first time only)
@@ -32,6 +38,55 @@
         pds_admin_password: "{{ existing_secrets.stdout_lines | select('match', '^PDS_ADMIN_PASSWORD=') | first | regex_replace('^PDS_ADMIN_PASSWORD=', '') }}"
         pds_plc_rotation_key: "{{ existing_secrets.stdout_lines | select('match', '^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=') | first | regex_replace('^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=', '') }}"
 
+    - name: Install rclone
+      apt:
+        name: rclone
+        state: present
+        update_cache: yes
+
+    - name: Create rclone config directory
+      file:
+        path: /etc/rclone
+        state: directory
+        mode: "0755"
+
+    - name: Deploy rclone config
+      template:
+        src: templates/rclone.conf.j2
+        dest: /etc/rclone/rclone.conf
+        mode: "0600"
+      notify: apply changes
+
+    - name: Deploy backup script
+      template:
+        src: templates/backup.sh.j2
+        dest: /usr/local/bin/backup.sh
+        mode: "0755"
+      notify: apply changes
+
+    - name: Deploy backup service
+      template:
+        src: templates/backup.service.j2
+        dest: /etc/systemd/system/pds-backup.service
+        mode: "0644"
+
+    - name: Deploy backup timer
+      template:
+        src: templates/backup.timer.j2
+        dest: /etc/systemd/system/pds-backup.timer
+        mode: "0644"
+
+    - name: Enable backup timer
+      systemd:
+        name: pds-backup.timer
+        enabled: yes
+        state: started
+        daemon_reload: yes
+
+    - name: Pre-deploy backup
+      shell: /usr/local/bin/backup.sh predeploy
+      when: existing_secrets.stdout_lines | length > 0
+
     - name: Deploy pds.env
       template:
         src: templates/pds.env.j2