feat: add PDS backup service with rclone + S3

Three backup types: pre-update (Watchtower lifecycle hook),
pre-deploy (Ansible task), and periodic (systemd timer).
All uploads go to OVH S3 via rclone. Backs up SQLite DBs,
pds.env, and Caddy config.

👾 Generated with [Letta Code](https://letta.com)

Co-Authored-By: Letta Code <noreply@letta.com>

templates/rclone.conf.j2

@@ -0,0 +1,9 @@
+[pds-backup]
+type = s3
+provider = OVH
+env_auth = false
+access_key_id = {{ pds_backup_s3_access_key }}
+secret_access_key = {{ pds_backup_s3_secret_key }}
+region = {{ pds_backup_s3_region }}
+endpoint = {{ pds_backup_s3_endpoint }}
+force_path_style = true