Litestream replication to the NAS and nightly media backup

Add a litestream service (0.5.17) to the compose stack that streams
/data/mealquest.db over SFTP to the Synology NAS with a dedicated key,
daily snapshots kept for a week. Add a systemd timer that rsyncs the
media directory to the NAS nightly at 03:30.

Task: d2f2e87e-5114-4ef1-93ab-360ffb5c009e

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/compose.yaml

@@ -46,6 +46,42 @@ services:
     cap_drop:
       - ALL
 
+  # Litestream streams the database to the Synology NAS over SFTP
+  # (config: deploy/litestream.yml). The SFTP private key
+  # deploy/secrets/litestream_key is a dedicated keypair, owned by
+  # 10001:10001 with mode 0600 like the other secrets.
+  #
+  # The data volume is mounted read-write on purpose: Litestream writes its
+  # tracking tables into the database and checkpoints the WAL. It runs as
+  # the app's own user (owner of the volume) with a read-only root
+  # filesystem, no privilege escalation and no Linux capabilities.
+  #
+  # Restore (app stopped; --no-deps so the app does not start and create a
+  # fresh database first):
+  #   docker compose -f deploy/compose.yaml run --rm --no-deps litestream \
+  #     restore -config /etc/litestream.yml -o /data/mealquest.db /data/mealquest.db
+  litestream:
+    image: litestream/litestream:0.5.17
+    user: "10001:10001"
+    restart: unless-stopped
+    command: ["replicate", "-config", "/etc/litestream.yml"]
+    depends_on:
+      mealquest:
+        condition: service_healthy
+    volumes:
+      - mealquest-data:/data
+      - ./litestream.yml:/etc/litestream.yml:ro
+      - ./secrets/litestream_key:/etc/litestream/sftp_key:ro
+    networks:
+      - mealquest
+    read_only: true
+    tmpfs:
+      - /tmp
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
 secrets:
   secret_key:
     file: ./secrets/secret_key