Native VM install kit: systemd units, launcher, install and upgrade scripts; backups, restore and doctor without docker exec; DEPLOY.md VM, NPM and NFS sections

Co-Authored-By: Claude Opus 5.5 <[email protected]>

deploy/vm/systemd/packetstation-migrate.service

@@ -0,0 +1,52 @@
+# Packet Station: SQL migrations, once per boot and once per upgrade, before the app and the worker.
+# Installed by deploy/vm/install.sh into /etc/systemd/system. See docs/DEPLOY.md, "Native VM install".
+# ps-upgrade restarts this unit after switching /opt/packetstation/current to a new release.
+[Unit]
+Description=Packet Station database migrations
+Documentation=file:///opt/packetstation/current/docs/DEPLOY.md
+Wants=[email protected] network-online.target
+After=[email protected] network-online.target
+Before=packetstation-app.service packetstation-worker.service
+ConditionPathExists=/opt/packetstation/current/deploy/vm/ps-launch.sh
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+User=packetstation
+Group=packetstation
+EnvironmentFile=/etc/packetstation/packetstation.env
+# migrate needs both passwords: it logs in as ps_migrate and grants to ps_app.
+LoadCredential=postgres_migrate_password:/etc/packetstation/secrets/postgres_migrate_password
+LoadCredential=postgres_app_password:/etc/packetstation/secrets/postgres_app_password
+ExecStart=/opt/packetstation/current/deploy/vm/ps-launch.sh migrate
+SyslogIdentifier=packetstation-migrate
+TimeoutStartSec=15min
+WorkingDirectory=/
+UMask=0027
+
+# Sandbox. The whole file system is read-only; migrate writes nothing outside PostgreSQL.
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+InaccessiblePaths=/etc/packetstation/secrets
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=invisible
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+RemoveIPC=yes
+CapabilityBoundingSet=
+AmbientCapabilities=
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+# No [Install]: the app and the worker pull this unit in (Requires=).