feat: Phase 13 — off-site backup with rclone + crypt encryption

Adds cloud sync extension to the daily backup script using rclone
with client-side AES-256 encryption. Includes interactive setup
script for configuring OneDrive, Google Drive, or any rclone provider.

- scripts/setup-rclone.sh: interactive NAS rclone installer + config
- scripts/cloud-backup.sh: sourced by backup.sh when CLOUD_ENABLED=true
- backup.sh: cloud sync step runs after local backup

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backup.sh

@@ -11,6 +11,14 @@ ERRORS=0
 
 [ -f "$SCRIPT_DIR/.env" ] && source "$SCRIPT_DIR/.env"
 
+# Source cloud backup extension (Phase 13 — Off-site Backup)
+CLOUD_ENABLED="${CLOUD_ENABLED:-false}"
+if [ "$CLOUD_ENABLED" = "true" ]; then
+    RCLONE_CONFIG_DIR="${RCLONE_CONFIG_DIR:-$SCRIPT_DIR/rclone}"
+    CLOUD_RETENTION_DAYS="${CLOUD_RETENTION_DAYS:-30}"
+    source "$SCRIPT_DIR/scripts/cloud-backup.sh"
+fi
+
 mkdir -p "$BACKUP_DIR"
 
 log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1"; }
@@ -66,6 +74,11 @@ find "$BACKUP_DIR" -type f \( -name "*.sql" -o -name "*.tar.gz" \) -mtime +$RETE
 # Summary
 log "=== Backup finished ($ERRORS errors) ==="
 
+# Off-site cloud sync
+if [ "$CLOUD_ENABLED" = "true" ] && type cloud_backup &>/dev/null; then
+    cloud_backup || ERRORS=$((ERRORS + CLOUD_ERRORS))
+fi
+
 if [ $ERRORS -gt 0 ]; then
     notify "🔴 *NAS Backup FAILED* ($DATE)
 $ERRORS error(s) — check logs"