Fix Nextcloud file-drop WebDAV URL for backup uploads.

Public file-drop shares require /public.php/dav/filesdrop/<token>/;
/public.php/webdav/ returns HTTP 409 on PUT.

docs/backup-restore.md

@@ -46,13 +46,23 @@ grep "public key" ~/.config/age/railiance-backup.key
 
 ## Destination
 
-Backups are uploaded to a Nextcloud file drop (upload-only, no credentials
-required to write, cannot be read back without Nextcloud admin access). The
-endpoint URL is stored locally in `wiki/260225-backup-dropoff-link.txt`
-(gitignored).
+Backups are uploaded to a Nextcloud **file drop** share (upload-only; cannot be
+read back without Nextcloud admin access). The human-facing share link is in
+`260225-backup-dropoff-link.txt`; credentials live in OpenBao
+(`platform/workloads/railiance/backup/offsite-lane`).
 
-Uploads use a direct HTTP PUT via curl — rclone is not used because Nextcloud
-file drop links only permit PUT requests.
+WebDAV uploads must target the **filesdrop** endpoint, not generic WebDAV:
+
+```text
+https://<host>/public.php/dav/filesdrop/<share-token>/<filename>
+```
+
+Using `/public.php/webdav/` returns HTTP **409** (*Files cannot be created in
+non-existent collections*) on current Nextcloud — that path is not valid for
+public file-drop shares.
+
+Uploads use a direct HTTP PUT via curl (`-u <token>:`). rclone is optional;
+the backup scripts do not require it.
 
 A local cache of the last 7 backups of each type is kept in
 `~/.cache/railiance/backups/`.

tools/cmd/railiance-backup

@@ -17,7 +17,7 @@ if [[ -z "${NC_TOKEN}" || -z "${NC_WEBDAV_URL}" ]] && command -v bao >/dev/null
     NC_WEBDAV_URL="$(bao kv get -field=NC_WEBDAV_URL "${BAO_PATH}")"
   fi
 fi
-: "${NC_WEBDAV_URL:=https://nx4069.your-storageshare.de/public.php/webdav}"
+: "${NC_WEBDAV_URL:=https://nx4069.your-storageshare.de/public.php/dav/filesdrop/${NC_TOKEN}}"
 if [[ -z "${NC_TOKEN}" ]]; then
   bad "credentials" "set RAILIANCE_BACKUP_NC_TOKEN or: bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read"
   exit 1