feat: daily encrypted database backup to a bucket of its own

A backup service runs pg_dump every day at 03:00 Brasília, checks the archive,
encrypts it with age to a public key and uploads it with a token for that
bucket only. The server cannot read or delete backups: the private key stays
with the owner, the bucket's lifecycle rule expires copies and its lock stops
early deletion. Each run is recorded and shown on the Kanban's Integrations
tab. tests/backup_test.py backs up, restores into a scratch database and
compares the rows in CI. Setup and restore: docs/BACKUP.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -183,6 +183,34 @@ services:
       replicas: 1
       restart_policy: {condition: on-failure, delay: 5s}
 
+  # Daily encrypted copy of the database to a bucket of its own, off this
+  # server (ops/db_backup.py). Idle until the BACKUP_* settings are set. The
+  # bucket's lifecycle rule removes old copies; this credential never deletes.
+  backup:
+    image: ${API_IMAGE:-gitea.blyzer.com.br/blyzer/dtf-api}:${IMAGE_TAG:-latest}
+    command: python -m ops.db_backup serve
+    environment:
+      DATABASE_ADMIN_HOST: db
+      DATABASE_ADMIN_NAME: dtf
+      DATABASE_ADMIN_USER: dtf_admin
+      DATABASE_ADMIN_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
+      # The R2 account endpoint (the same as R2_ENDPOINT) and a bucket and API
+      # token for backups only, never the artwork bucket's.
+      BACKUP_S3_ENDPOINT: ${BACKUP_S3_ENDPOINT:-}
+      BACKUP_BUCKET: ${BACKUP_BUCKET:-}
+      BACKUP_ACCESS_KEY_ID: ${BACKUP_ACCESS_KEY_ID:-}
+      BACKUP_SECRET_ACCESS_KEY: ${BACKUP_SECRET_ACCESS_KEY:-}
+      # The public key (age1...). Its private key stays off this server.
+      BACKUP_AGE_RECIPIENT: ${BACKUP_AGE_RECIPIENT:-}
+      # Hour of day in Brasília.
+      BACKUP_HOUR: ${BACKUP_HOUR:-3}
+    networks: [backend, egress]
+    read_only: true
+    tmpfs: [/tmp]
+    deploy:
+      replicas: 1
+      restart_policy: {condition: on-failure, delay: 30s}
+
   site:
     image: ${WEB_IMAGE:-gitea.blyzer.com.br/blyzer/dtf-web}:${IMAGE_TAG:-latest}
     environment: