feat: add PDS backup service with rclone + S3

Three backup types: pre-update (Watchtower lifecycle hook),
pre-deploy (Ansible task), and periodic (systemd timer).
All uploads go to OVH S3 via rclone. Backs up SQLite DBs,
pds.env, and Caddy config.

👾 Generated with [Letta Code](https://letta.com)

Co-Authored-By: Letta Code <noreply@letta.com>

templates/compose.yaml.j2

@@ -8,6 +8,21 @@ services:
       - type: bind
         source: {{ pds_data_dir }}
         target: {{ pds_data_dir }}
+      - type: bind
+        source: /usr/bin/rclone
+        target: /usr/local/bin/rclone
+        read_only: true
+      - type: bind
+        source: /etc/rclone/rclone.conf
+        target: /etc/rclone/rclone.conf
+        read_only: true
+      - type: bind
+        source: /usr/local/bin/backup.sh
+        target: /usr/local/bin/backup.sh
+        read_only: true
+    labels:
+      - com.centurylinklabs.watchtower.lifecycle.pre-update=/usr/local/bin/backup.sh preupdate
+      - com.centurylinklabs.watchtower.lifecycle.pre-update-timeout=2
     env_file:
       - {{ pds_data_dir }}/pds.env
 
@@ -36,3 +51,4 @@ services:
     environment:
       - WATCHTOWER_CLEANUP=true
       - WATCHTOWER_POLL_INTERVAL=3600
+      - WATCHTOWER_LIFECYCLE_HOOKS=true