feat: add PDS backup service with rclone + S3

Three backup types: pre-update (Watchtower lifecycle hook),
pre-deploy (Ansible task), and periodic (systemd timer).
All uploads go to OVH S3 via rclone. Backs up SQLite DBs,
pds.env, and Caddy config.

👾 Generated with [Letta Code](https://letta.com)

Co-Authored-By: Letta Code <noreply@letta.com>

templates/backup.sh.j2

@@ -0,0 +1,29 @@
+#!/bin/bash
+set -euo pipefail
+
+BACKUP_TYPE="${1:-periodic}"
+DATA_DIR="{{ pds_data_dir }}"
+BACKUP_BUCKET="{{ pds_backup_s3_bucket }}"
+RCLONE="rclone"
+RCLONE_CONFIG="/etc/rclone/rclone.conf"
+TIMESTAMP=$(date -u +%Y%m%d-%H%M%S)
+BACKUP_NAME="${BACKUP_TYPE}-${TIMESTAMP}.tar.gz"
+TMP_DIR="/tmp/pds-backup-$$"
+
+cleanup() {
+    rm -rf "$TMP_DIR"
+}
+trap cleanup EXIT
+
+mkdir -p "$TMP_DIR"
+
+# Create tarball of PDS data
+tar czf "$TMP_DIR/$BACKUP_NAME" \
+    -C "$(dirname "$DATA_DIR")" \
+    "$(basename "$DATA_DIR")"
+
+# Upload to S3
+$RCLONE copy "$TMP_DIR/$BACKUP_NAME" "pds-backup:$BACKUP_BUCKET/" \
+    --config "$RCLONE_CONFIG"
+
+echo "Backup complete: ${BACKUP_NAME} -> ${BACKUP_BUCKET}"