feat: Backup-Skript mit 20 Tage Aufbewahrung + Restore

scripts/backup.sh:
- MySQL-Dump (utf8mb4, single-transaction, routines, triggers) -> gz
- Uploads-Volume per alpine-tar -> tar.gz
- Loescht Backups aelter als 20 Tage (find -mtime)
- Liest MYSQL_PASSWORD via grep aus .env (kein source -
  .env enthaelt MAIL_FROM mit <> die bash sonst als Redirect deutet)
- Konfigurierbar via env PROJECT_DIR/BACKUP_DIR/RETENTION_DAYS

scripts/restore.sh:
- Listet verfuegbare Backups bei Aufruf ohne Argument
- Modi: full (default), db-only, uploads-only
- Sicherheitsabfrage vor Ueberschreiben

Cron auf Server: taeglich 03:00 -> /var/log/pfandsystem-demo-backup.log
Backup-Ziel: /root/backups/pfandsystem-demo/

scripts/backup.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Dockly-Pfandsystem Demo - Backup-Skript
+# Sichert MySQL-Dump + Uploads-Volume. Aufbewahrung: 20 Tage.
+
+set -euo pipefail
+
+PROJECT_DIR="${PROJECT_DIR:-/root/pfandsystem-demo}"
+BACKUP_DIR="${BACKUP_DIR:-/root/backups/pfandsystem-demo}"
+RETENTION_DAYS="${RETENTION_DAYS:-20}"
+TIMESTAMP="$(date +%Y-%m-%d_%H-%M)"
+
+# Passwort aus .env extrahieren (ohne source - .env hat Werte mit < > die bash sonst stoeren)
+MYSQL_PASSWORD="$(grep -E '^MYSQL_PASSWORD=' "$PROJECT_DIR/.env" | head -n1 | cut -d= -f2-)"
+if [[ -z "$MYSQL_PASSWORD" ]]; then
+  echo "FEHLER: MYSQL_PASSWORD nicht in $PROJECT_DIR/.env gefunden" >&2
+  exit 1
+fi
+
+mkdir -p "$BACKUP_DIR"
+
+# 1) MySQL-Dump
+DB_FILE="$BACKUP_DIR/db_${TIMESTAMP}.sql.gz"
+echo "[$(date +%T)] DB-Dump -> $DB_FILE"
+docker exec pfandsystem-demo-mysql \
+  mysqldump --default-character-set=utf8mb4 \
+            --single-transaction --routines --triggers \
+            -upfandsystem -p"${MYSQL_PASSWORD}" pfandsystem_demo \
+  2>/dev/null | gzip > "$DB_FILE"
+
+# 2) Uploads-Volume
+UPLOADS_FILE="$BACKUP_DIR/uploads_${TIMESTAMP}.tar.gz"
+echo "[$(date +%T)] Uploads-Backup -> $UPLOADS_FILE"
+docker run --rm \
+  -v pfandsystem-demo_backend_uploads:/data:ro \
+  -v "$BACKUP_DIR":/backup \
+  alpine:3 \
+  tar czf "/backup/uploads_${TIMESTAMP}.tar.gz" -C /data .
+
+# 3) Alte Backups loeschen
+echo "[$(date +%T)] Aufraeumen (>${RETENTION_DAYS} Tage)"
+find "$BACKUP_DIR" -maxdepth 1 -type f \
+  \( -name 'db_*.sql.gz' -o -name 'uploads_*.tar.gz' \) \
+  -mtime "+${RETENTION_DAYS}" -delete
+
+# 4) Zusammenfassung
+DB_SIZE=$(du -h "$DB_FILE" | cut -f1)
+UP_SIZE=$(du -h "$UPLOADS_FILE" | cut -f1)
+TOTAL_SIZE=$(du -sh "$BACKUP_DIR" | cut -f1)
+FILE_COUNT=$(find "$BACKUP_DIR" -maxdepth 1 -type f | wc -l)
+
+echo "[$(date +%T)] Backup fertig"
+echo "  DB:      $DB_SIZE ($DB_FILE)"
+echo "  Uploads: $UP_SIZE ($UPLOADS_FILE)"
+echo "  Backup-Verzeichnis gesamt: $TOTAL_SIZE ($FILE_COUNT Dateien)"