feat: nightly rsync backup to tank with rrsync-restricted key and sanoid history

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/tank-side.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+# Run on pve173: ssh pve173 'bash -s' -- "<pubkey>" < scripts/tank-side.sh
+set -euo pipefail
+PUB=${1:?pubkey line required}
+[[ $PUB == ssh-ed25519* ]] || { echo "not a pubkey: $PUB"; exit 1; }
+DS=tank/backups/mac; TS=$(date +%s)
+zfs list "$DS" >/dev/null 2>&1 && echo "[skip] dataset $DS" || { zfs create "$DS"; echo "[set] created $DS"; }
+if grep -q "^\[$DS\]" /etc/sanoid/sanoid.conf; then echo "[skip] sanoid stanza"; else
+  mkdir -p /etc/sanoid/.backup; cp /etc/sanoid/sanoid.conf "/etc/sanoid/.backup/sanoid.conf-$TS"
+  printf '\n[%s]\n\tuse_template = tank_media\n' "$DS" >> /etc/sanoid/sanoid.conf; echo "[set] sanoid stanza"
+fi
+KEYLINE="restrict,command=\"/usr/bin/rrsync /$DS\" $PUB"
+if grep -qF "$PUB" /root/.ssh/authorized_keys; then echo "[skip] key present"; else
+  cp /root/.ssh/authorized_keys "/root/.ssh/authorized_keys.bak-$TS"
+  echo "$KEYLINE" >> /root/.ssh/authorized_keys; echo "[set] rrsync-restricted key added"
+fi