backup-master: сервер бэкапов, агент и восстановление VPS

Один бинарник backupctl:
- server: API для агентов и restore, веб-морда (один админ), SQLite,
  ретеншн GFS, heavy-части, уведомления ntfy, раздача agent.sh/restore.sh;
- backup/plan: сбор по каталогу категорий (files/systemd/xui/compose),
  горячие дампы Postgres/Mongo/MySQL, снимок x-ui.db, docker-тома,
  digest образов, проверка crontab, потоковая отправка tar.zst;
- restore: провижининг на основе vps_installer с теми же версиями пакетов,
  recipes 3x-ui/nebula/sing-box нужных версий, восстановление compose
  с заливкой дампов и закреплением образов по digest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/catalog/default.yaml

@@ -0,0 +1,91 @@
+# Встроенный каталог категорий. Переопределяется конфигом клиента в веб-морде:
+# категория с тем же name заменяется целиком, `- {name: X, disabled: true}` отключает её.
+
+auto_compose: true
+
+exclude:
+  - "*.swp"
+
+categories:
+  - name: system
+    type: files
+    paths:
+      - /etc/ufw/user.rules
+      - /etc/ufw/user6.rules
+      - /var/spool/cron/crontabs
+      - /etc/cron.d/ban-blacklist
+      - /usr/local/sbin/ban.sh
+      - /etc/sysctl.d
+    post_restore:
+      - "ufw reload || true"
+      - "sysctl --system >/dev/null || true"
+
+  - name: xui
+    type: xui
+    detect: [/usr/local/x-ui/x-ui]
+    paths: [/etc/x-ui, /root/cert]
+    exclude: ["/etc/x-ui/x-ui.db*"]
+    service: x-ui
+    version_cmd: [/usr/local/x-ui/x-ui, -v]
+    install: xui
+    keep_binaries: [/usr/local/x-ui, /usr/bin/x-ui, /etc/systemd/system/x-ui.service]
+
+  - name: nebula
+    type: systemd
+    detect: [/etc/nebula]
+    paths: [/etc/nebula, /etc/systemd/system/nebula.service]
+    service: nebula
+    version_cmd: [/usr/local/bin/nebula, -version]
+    install: nebula
+    keep_binaries: [/usr/local/bin/nebula, /usr/local/bin/nebula-cert]
+
+  - name: caddy
+    type: systemd
+    detect: [/etc/caddy/Caddyfile]
+    paths: [/etc/caddy, /var/www, /var/lib/caddy/.local/share/caddy]
+    service: caddy
+
+  - name: telegraf
+    type: systemd
+    detect: [/etc/telegraf]
+    paths: [/etc/telegraf, /etc/sudoers.d/telegraf]
+    service: telegraf
+
+  - name: sing-box-warp
+    type: systemd
+    detect: [/opt/sing-box-warp]
+    paths:
+      - /opt/sing-box-warp
+      - /etc/sing-box-warp
+      - /etc/systemd/system/sing-box-warp.service
+      - /etc/sysctl.d/99-sing-box-warp.conf
+    service: sing-box-warp
+    version_cmd: [/usr/local/bin/sing-box, version]
+    version_regex: 'version\s+(\S+)'
+    install: sing-box-extended
+    keep_binaries: [/usr/local/bin/sing-box]
+    ensure_dirs: [/var/cache/sing-box-warp]
+
+  - name: scripts
+    type: files
+    paths: [/var/scripts, /usr/local/bin/update-geosite.sh]
+
+  - name: pnvpanel
+    type: compose
+    dir: /opt/PnvPanel
+
+  - name: stoat
+    type: compose
+    dir: /opt/stoat
+    skip_services: [rabbit, redis]
+    heavy_paths: [data/minio]
+
+  - name: stoat-mbot
+    type: compose
+    dir: /opt/stoat-mbot
+    restore_after: [stoat]
+
+  - name: psiphon
+    type: compose
+    dir: /opt/psiphon
+    disabled: true