fix: rewrite backup script — extract via Docker, rsync from host

Avoids SSH-inside-container complexity. Docker cp to /tmp,
native rsync to NAS, Docker cleanup for root-owned files.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/backup_to_nas.sh

@@ -3,21 +3,30 @@
 # Cron: 0 3 * * * /home/stephan/stacks/plantdb/scripts/backup_to_nas.sh >> /var/log/plantdb_backup.log 2>&1
 set -euo pipefail
 
-NAS_USER="stephan"
-NAS_HOST="192.168.178.110"
+NAS_USER="admin"
+NAS_HOST="nas"
 NAS_PATH="/share/MD0_DATA/Public/plantdb_backup"
 SSH_KEY="/home/stephan/.ssh/plantdb_backup"
+TMP_DIR="/tmp/plantdb_backup_$$"
 
+cleanup() {
+  docker run --rm -v "${TMP_DIR}:/dst" alpine sh -c "rm -rf /dst/db /dst/media"
+  rmdir "${TMP_DIR}"
+}
+trap cleanup EXIT
+
+mkdir -p "${TMP_DIR}/db" "${TMP_DIR}/media"
+
+# Extract volume data to tmp dir
 docker run --rm \
-  -v plantdb_db:/data/db:ro \
-  -v plantdb_media:/data/media:ro \
-  -v "${SSH_KEY}:/root/.ssh/id_ed25519:ro" \
-  alpine sh -c "
-    apk add --no-cache rsync openssh-client -q 2>/dev/null
-    mkdir -p /root/.ssh
-    ssh-keyscan -H ${NAS_HOST} > /root/.ssh/known_hosts 2>/dev/null
-    rsync -av --delete /data/db/   ${NAS_USER}@${NAS_HOST}:${NAS_PATH}/db/
-    rsync -av --delete /data/media/ ${NAS_USER}@${NAS_HOST}:${NAS_PATH}/media/
-  "
+  -v plantdb_db:/src/db:ro \
+  -v plantdb_media:/src/media:ro \
+  -v "${TMP_DIR}:/dst" \
+  alpine sh -c "cp -a /src/db/. /dst/db/ && cp -a /src/media/. /dst/media/"
+
+# Sync to NAS
+rsync -av --delete \
+  -e "ssh -i ${SSH_KEY} -o StrictHostKeyChecking=no" \
+  "${TMP_DIR}/" "${NAS_USER}@${NAS_HOST}:${NAS_PATH}/"
 
 echo "[$(date '+%Y-%m-%d %H:%M:%S')] plantdb backup complete"