M2c-pi: Pi bundle (infra/pi), cert-sync, Drive backup upload, Gitea workflow

The owner copies infra/pi/ to the Kvitt Pi and runs it there (D-100); nothing
on the Mac connects to the Pis. compose stack of SPEC §10.2 with images
${KVITT_REGISTRY}/kvitt-{server,cert-sync,backup}, Caddyfile §10.5.2 verbatim,
.env.example with the OQ-3 values as CHANGE_ME placeholders, install.sh,
deploy.sh (backup before every deploy), bootstrap.sh, backup-now.sh,
install-apk.sh. cert-sync image and sync.sh (§10.5.1, tar stream for both
authorized_keys variants); backup.sh uploads with rclone copy --immutable and
deletes local files once both are confirmed on Drive (D-002); both sidecars
schedule with supercronic because busybox crond runs no jobs as non-root;
backup runs as uid 10001. .gitea/workflows/build-images.yaml from the owner's
example (not yet run); infra/build-images.sh and infra/publish-apk.sh (R8
mapping kept, version per §10.6) on the Mac; README checklist and RESTORE.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/backup/backup.sh

@@ -3,9 +3,11 @@
 #  1. online, consistent snapshot of /data/kvitt.sqlite with sqlite3 .backup
 #  2. PRAGMA integrity_check on the snapshot must print ok, else abort
 #  3. gzip -9 the snapshot and tar the pictures, both with the same UTC stamp
-#  4. Drive upload: skipped when RCLONE_FOLDER_ID is empty (the development stack, D-001);
-#     the upload itself and the D-002 local deletion are built by M2c-pi
-#  5. write /backups/last-success with the stamp
+#  4. Drive upload when RCLONE_FOLDER_ID is set (the Pi): rclone copy --immutable of every kvitt-*.sqlite.gz and
+#     pictures-*.tar.gz in /backups (this run's pair and any left by an earlier failed upload), never sync, never
+#     delete on Drive; once every file is confirmed on Drive with rclone lsf (name and size) the local copies are
+#     deleted (D-002). Skipped with a log line when RCLONE_FOLDER_ID is empty (the development stack, D-001): files kept.
+#  5. write /backups/last-success with the stamp (only after this run's pair is confirmed on Drive, when uploading)
 # Logs carry file names and sizes only, never database content (SPEC §8.7).
 set -eu
 
@@ -44,13 +46,36 @@ fi
 mv "$pics_out.tmp" "$pics_out"
 log "wrote $(basename "$db_out") ($(wc -c < "$db_out") bytes) and $(basename "$pics_out") ($(wc -c < "$pics_out") bytes)"
 
-# 4. Drive upload
+# 4. Drive upload (D-002)
 if [ -z "${RCLONE_FOLDER_ID:-}" ]; then
   log "RCLONE_FOLDER_ID is empty: Drive upload skipped, local files kept"
 else
-  # TODO(M2c-pi): rclone copy --immutable to "${RCLONE_REMOTE:-gdrive:}" --drive-root-folder-id, confirm with
-  # rclone lsf, then delete the local files (D-002). Not part of the development stack (D-001).
-  fail "RCLONE_FOLDER_ID is set but the Drive upload is not built yet (M2c-pi); local files kept"
+  remote=${RCLONE_REMOTE:-gdrive:}
+  conf_src=${RCLONE_CONFIG_SOURCE:-/config/rclone/rclone.conf}
+  [ -r "$conf_src" ] || fail "no readable rclone config at $conf_src; local files kept"
+  # rclone writes refreshed access tokens back to its config; the mounted one is read-only, so use a private copy.
+  conf=$(mktemp)
+  cp "$conf_src" "$conf"
+  export RCLONE_CONFIG="$conf"
+  trap 'rm -f "$conf"' EXIT
+  confirmed=""
+  for f in "$BACKUP_DIR"/kvitt-*.sqlite.gz "$BACKUP_DIR"/pictures-*.tar.gz; do
+    [ -f "$f" ] || continue
+    name=$(basename "$f")
+    size=$(wc -c < "$f" | tr -d ' ')
+    rclone copy "$f" "$remote" --drive-root-folder-id "$RCLONE_FOLDER_ID" --immutable --retries 3 --stats 0 --log-level ERROR \
+      || fail "rclone copy of $name failed; local files kept"
+    listed=$(rclone lsf "$remote" --drive-root-folder-id "$RCLONE_FOLDER_ID" --files-only --format sp --separator ' ' \
+      --include "/$name" --log-level ERROR) || fail "rclone lsf could not confirm $name; local files kept"
+    [ "$listed" = "$size $name" ] || fail "$name is not on Drive with $size bytes; local file kept"
+    log "uploaded and confirmed on Drive: $name ($size bytes)"
+    confirmed="$confirmed $f"
+  done
+  # Every file is confirmed on Drive: delete the local copies (D-002). Nothing on Drive is ever deleted.
+  for f in $confirmed; do rm -f "$f"; done
+  log "local copies deleted after Drive confirmation"
+  rm -f "$conf"
+  trap - EXIT
 fi
 
 # 5. Success marker