fix: backup — mariadb-dump, --skip-ssl, SSH-Key per Volume in Compose

- mariadb-dump statt mysqldump (kein Deprecation-Warning in Alpine)
  via BACKUP_DUMP_CMD konfigurierbar (Fallback für lokale MySQL-Umgebung)
- --skip-ssl unterdrückt MariaDB-SSL-Warnung bei MYSQL_PWD-Nutzung
- docker-compose.prod.yml: BACKUP_SSH_URL + Key-Volume (BACKUP_SSH_KEY_FILE)
  damit SSH-Alias-Auflösung und Key-Zugriff im Container funktionieren

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -48,6 +48,10 @@ services:
       DB_NAME: ${DB_NAME}
       AUTH_SECRET: ${AUTH_SECRET}
       NODE_ENV: production
+      BACKUP_SSH_URL: ${BACKUP_SSH_URL}
+      BACKUP_SSH_KEY_PATH: /run/secrets/backup_ssh_key
+    volumes:
+      - ${BACKUP_SSH_KEY_FILE}:/run/secrets/backup_ssh_key:ro
     ports:
       - "127.0.0.1:${APP_PORT:-3000}:3000"
     depends_on:

lib/backup.ts

@@ -34,9 +34,12 @@ async function runBackup(): Promise<void> {
     '-o', 'BatchMode=yes',
   ];
 
+  const dumpBin = process.env.BACKUP_DUMP_CMD || 'mariadb-dump';
+
   await new Promise<void>((resolve, reject) => {
-    const dump = spawn('mysqldump', [
+    const dump = spawn(dumpBin, [
       `-h${dbHost}`, `-P${dbPort}`, `-u${dbUser}`,
+      '--skip-ssl',
       `--ignore-table=${dbName}.beos`,
       dbName,
     ], { env: { ...process.env, MYSQL_PWD: dbPass } });