feat(backup): add ops-db backup commands, flow, and systemd timer

Adds pg_dump_ops_db, list_ops_backups, and cleanup_ops_backups to the
agent command whitelist. Includes a backup_ops_db flow YAML (dump +
30-day retention), and a systemd service/timer for daily automated
backups at 02:00.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

deploy/ops-agent/ops-db-backup.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=Daily backup of ops_dashboard database
+After=network.target ops-agent.service
+
+[Service]
+Type=oneshot
+User=ops-agent
+Group=ops-agent
+# Reads the shared secret and POSTs to ops-agent to trigger the backup flow.
+# ops-agent must be running and backup_ops_db.yml must be installed in /etc/ops-agent/flows/.
+ExecStart=/usr/bin/bash -c '\
+  SECRET=$(cat /etc/ops-agent/secret); \
+  curl -sf -X POST http://127.0.0.1:3099/agent/v1/flow \
+    -H "Authorization: Bearer $SECRET" \
+    -H "Content-Type: application/json" \
+    -d "{\"flow_key\":\"backup_ops_db\"}" \
+'
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=ops-db-backup

deploy/ops-agent/ops-db-backup.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Daily backup of ops_dashboard database (timer)
+
+[Timer]
+# Run every day at 02:00 local time.
+OnCalendar=*-*-* 02:00:00
+Persistent=true
+
+[Install]
+WantedBy=timers.target