fix: set_env newline-safe — RESTIC_REPOSITORY was glued onto a comment line (backups broke)

backup-bot-two's .env.sample ends with a newline-less comment, so set_env's bare
append concatenated RESTIC_REPOSITORY onto it (commenting it out). The backupbot
container then lacked RESTIC_REPOSITORY and 'abra app backup create' KeyError'd —
breaking the backup stage for recipes without a custom backup hook (cryptpad).
set_env now ensures a trailing newline before appending (applied to drone.nix too,
same latent bug). Re-verify keycloak backup, which earlier passed off an older deploy.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

modules/backupbot.nix

@@ -18,6 +18,10 @@ let
 
       set_env() {
         sed -i -E "/^[[:space:]]*#?[[:space:]]*$1=/d" "$ENV_FILE"
+        # Ensure the file ends in a newline before appending — backup-bot-two's .env.sample ends
+        # with a newline-less comment line, so a bare append would glue the var onto that comment
+        # (commenting it out). `$(tail -c1)` is empty iff the last byte is already a newline.
+        if [ -s "$ENV_FILE" ] && [ -n "$(tail -c1 "$ENV_FILE")" ]; then printf '\n' >> "$ENV_FILE"; fi
         printf '%s=%s\n' "$1" "$2" >> "$ENV_FILE"
       }
       set_env RESTIC_REPOSITORY /backups/restic

modules/drone.nix

@@ -32,6 +32,9 @@ let
 
       set_env() {
         sed -i -E "/^[[:space:]]*#?[[:space:]]*$1=/d" "$ENV_FILE"
+        # ensure trailing newline before append (a recipe .env.sample may end without one, which
+        # would glue the var onto the last line — see modules/backupbot.nix for the bite).
+        if [ -s "$ENV_FILE" ] && [ -n "$(tail -c1 "$ENV_FILE")" ]; then printf '\n' >> "$ENV_FILE"; fi
         printf '%s=%s\n' "$1" "$2" >> "$ENV_FILE"
       }
       set_env LETS_ENCRYPT_ENV ""