admin: backup logs via parameters.php, nextcloud secondary backup

- surface backup/cleanup cron logs + backup freshness status
- email xamxam@erg.be when SQLite backups go stale (backup watchdog)
- sync SQLite snapshots to Nextcloud WebDAV + remote-freshness watchdog
- precise retention pruning, manual sync in check recipe, and Nextcloud-sync docs

scripts/backup-sqlite.sh

@@ -32,7 +32,23 @@ sqlite3 "$DB_PATH" ".backup $TMP_SNAPSHOT"
 gzip -c "$TMP_SNAPSHOT" > "$BACKUP_FILE"
 rm -f "$TMP_SNAPSHOT"
 
-# Prune old backups
-find "$BACKUP_DIR" -name "*.db.gz" -mtime "+${RETENTION_DAYS}" -delete 2>/dev/null || true
+# Prune old backups.
+# Use filename timestamps (deterministic) rather than -mtime, which has
+# day-rounding ambiguity (-mtime +N means N+1 days). Files are named
+# db-YYYY-MM-DDTHH-MM-SS.db.gz, so we delete anything whose date is more
+# than RETENTION_DAYS in the past.
+RETENTION_SECONDS=$((RETENTION_DAYS * 86400))
+NOW_EPOCH=$(date +%s)
+for f in "$BACKUP_DIR"/db-*.db.gz; do
+    [ -e "$f" ] || continue
+    base=$(basename "$f" .db.gz)          # db-YYYY-MM-DDTHH-MM-SS
+    stamp=${base#db-}                        # YYYY-MM-DDTHH-MM-SS
+    # Reformat YYYY-MM-DDTHH-MM-SS → YYYY-MM-DD HH:MM:SS for date(1).
+    named=$(echo "$stamp" | sed 's/T/ /; s/-/:/3g') || continue
+    ts=$(date -d "$named" +%s 2>/dev/null) || continue
+    if [ $((NOW_EPOCH - ts)) -gt $RETENTION_SECONDS ]; then
+        rm -f "$f"
+    fi
+done
 
 echo "[$(date '+%Y-%m-%d %H:%M:%S')] Backup written: $BACKUP_FILE ($(du -h "$BACKUP_FILE" | cut -f1))"