add backup support

backup_sqlite.py

@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+import os
+import sqlite3
+from pathlib import Path
+
+source_path = Path("/data/main.db")
+backup_dir = Path("/data/backup")
+temporary_path = backup_dir / "main.db.tmp"
+backup_path = backup_dir / "main.db"
+
+os.umask(0o077)
+backup_dir.mkdir(mode=0o700, parents=True, exist_ok=True)
+temporary_path.unlink(missing_ok=True)
+
+try:
+    # Read-only mode prevents silently creating an empty source database.
+    source = sqlite3.connect(
+        f"{source_path.as_uri()}?mode=ro",
+        uri=True,
+        timeout=60,
+    )
+    destination = sqlite3.connect(temporary_path)
+    try:
+        source.backup(destination, pages=256, sleep=0.1)
+        result = destination.execute("PRAGMA integrity_check").fetchall()
+        if result != [("ok",)]:
+            raise RuntimeError(f"SQLite integrity check failed: {result}")
+    finally:
+        destination.close()
+        source.close()
+    # Only publish a fully written, verified snapshot.
+    os.replace(temporary_path, backup_path)
+    print(f"SQLite backup ready: {backup_path}", flush=True)
+except Exception:
+    temporary_path.unlink(missing_ok=True)
+    raise