fix: backup — MYSQL_PWD statt -p Flag, SSH-Key optional

Passwort via MYSQL_PWD-Env statt -p vermeidet die mysqldump-Warnung
und ist sicherer. BACKUP_SSH_KEY_PATH ist jetzt optional: wenn leer,
wird kein -i übergeben und SSH nutzt seine eigene Konfiguration
(~/.ssh/config, ssh-agent). So funktionieren SSH-Config-Aliases
(z.B. 'strato_1') ohne Key-Override.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/backup.ts

@@ -14,7 +14,7 @@ async function runBackup(): Promise<void> {
     return;
   }
   const [, sshHost, remotePath] = match;
-  const rawKeyPath = process.env.BACKUP_SSH_KEY_PATH || '/app/.ssh/id_rsa';
+  const rawKeyPath = process.env.BACKUP_SSH_KEY_PATH || '';
   const keyPath = rawKeyPath.startsWith('~')
     ? rawKeyPath.replace('~', process.env.HOME || '/root')
     : rawKeyPath;
@@ -29,17 +29,17 @@ async function runBackup(): Promise<void> {
   const dbName = process.env.DB_NAME || 'sternwarte';
 
   const sshOpts = [
-    '-i', keyPath,
+    ...(keyPath ? ['-i', keyPath] : []),
     '-o', 'StrictHostKeyChecking=no',
     '-o', 'BatchMode=yes',
   ];
 
   await new Promise<void>((resolve, reject) => {
     const dump = spawn('mysqldump', [
-      `-h${dbHost}`, `-P${dbPort}`, `-u${dbUser}`, `-p${dbPass}`,
+      `-h${dbHost}`, `-P${dbPort}`, `-u${dbUser}`,
       `--ignore-table=${dbName}.beos`,
       dbName,
-    ]);
+    ], { env: { ...process.env, MYSQL_PWD: dbPass } });
     const gzip = spawn('gzip');
     const ssh = spawn('ssh', [...sshOpts, sshHost, `cat > ${remotePath}/${filename}`]);