Prepare independent ledger backup and isolated no-send recovery

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a11538-05ea-7b63-b3c7-a2df5f38898d

deploy/backup/email-connect-ledger-backup.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Coherent encrypted email-connect transactional ledger backup
+After=network-online.target k3s.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=root
+UMask=0077
+StateDirectory=email-connect-backup
+StateDirectoryMode=0700
+EnvironmentFile=/etc/email-connect-backup/primary.env
+ExecStart=/usr/bin/python3 /opt/email-connect-backup/backup-ledger.py backup --execute
+TimeoutStartSec=40min
+TimeoutStopSec=15min
+KillMode=mixed
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/email-connect-backup
+ProtectHome=true

deploy/backup/email-connect-ledger-backup.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Daily independent email-connect ledger recovery point
+
+[Timer]
+OnCalendar=*-*-* 04:15:00 UTC
+Persistent=true
+RandomizedDelaySec=5min
+Unit=email-connect-ledger-backup.service
+
+[Install]
+WantedBy=timers.target

deploy/backup/email-connect-ledger-freshness.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Check email-connect ledger archive age and local ciphertext hash
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/bin/python3 /opt/email-connect-backup/backup-ledger.py freshness
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true

deploy/backup/email-connect-ledger-freshness.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Hourly email-connect ledger backup freshness check
+
+[Timer]
+OnCalendar=hourly
+Persistent=true
+Unit=email-connect-ledger-freshness.service
+
+[Install]
+WantedBy=timers.target