fix(deploy): make LXC deploys atomic and fail-fast

Rebuild the deployment flow to prepare releases remotely, validate env/sudo prerequisites, run migrations in-release, and auto-rollback on health failures. Consolidate deployment docs and add a manual CI workflow so laptop and CI use the same push-based deploy path.

scripts/backup-database.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+#
+# Database backup script for innercontext PostgreSQL database
+# Should be run daily via cron on the PostgreSQL LXC:
+# 0 2 * * * /opt/innercontext/scripts/backup-database.sh >> /opt/innercontext/backup.log 2>&1
+#
+# Note: This script should be copied to the PostgreSQL LXC container
+# and run there (not on the app LXC)
+#
+
+set -euo pipefail
+
+# Configuration
+BACKUP_DIR="/opt/innercontext/backups"
+DB_NAME="innercontext"
+DB_USER="innercontext"
+KEEP_DAYS=7
+TIMESTAMP=$(date '+%Y%m%d_%H%M%S')
+BACKUP_FILE="$BACKUP_DIR/innercontext_${TIMESTAMP}.sql.gz"
+
+# Color codes
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+log() {
+    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1"
+}
+
+# Create backup directory if it doesn't exist
+mkdir -p "$BACKUP_DIR"
+
+# Create backup
+log "Starting database backup..."
+if pg_dump -U "$DB_USER" -d "$DB_NAME" | gzip > "$BACKUP_FILE"; then
+    BACKUP_SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
+    log "${GREEN}✓${NC} Backup created: $BACKUP_FILE ($BACKUP_SIZE)"
+else
+    log "${RED}✗${NC} Backup failed"
+    exit 1
+fi
+
+# Clean up old backups
+log "Cleaning up backups older than $KEEP_DAYS days..."
+find "$BACKUP_DIR" -name "innercontext_*.sql.gz" -type f -mtime +$KEEP_DAYS -delete
+REMAINING=$(find "$BACKUP_DIR" -name "innercontext_*.sql.gz" -type f | wc -l)
+log "${GREEN}✓${NC} Cleanup complete. $REMAINING backup(s) remaining"
+
+# Verify backup can be read
+if gunzip -t "$BACKUP_FILE" 2>/dev/null; then
+    log "${GREEN}✓${NC} Backup integrity verified"
+else
+    log "${RED}✗${NC} Backup integrity check failed"
+    exit 1
+fi
+
+log "${GREEN}✓${NC} Database backup completed successfully"
+exit 0