feat: Phase 13 — off-site backup with rclone + crypt encryption

Adds cloud sync extension to the daily backup script using rclone
with client-side AES-256 encryption. Includes interactive setup
script for configuring OneDrive, Google Drive, or any rclone provider.

- scripts/setup-rclone.sh: interactive NAS rclone installer + config
- scripts/cloud-backup.sh: sourced by backup.sh when CLOUD_ENABLED=true
- backup.sh: cloud sync step runs after local backup

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

PLAN.md

@@ -183,10 +183,10 @@ nas-tools/
 55. ~~Add LiteLLM dashboard UI page with sidebar link and health status card~~ — Done
 56. ~~Add cc-connect dashboard UI page, sidebar link, and backend health/status endpoint~~ — Done
 
-### Phase 13 — Off-site Backup
-46. Add cloud backup (OneDrive or Google Drive) for critical data
-47. Encrypt backups before upload
-48. Retention policy for cloud copies
+### Phase 13 — Off-site Backup ✅
+46. ~~Add cloud backup (OneDrive or Google Drive) for critical data~~ — Done (rclone + crypt encryption)
+47. ~~Encrypt backups before upload~~ — Done (rclone crypt AES-256)
+48. ~~Retention policy for cloud copies~~ — Done (30-day configurable via env var)
 
 ## Media Paths