Fix backup permission denied by using docker cp instead of direct mount write

The git user inside the gitea container couldn't write to the NAS-mounted
/tmp/backup directory. Now dumps to /tmp first, then uses docker cp to
extract the file to the sidecar's backup directory.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backup.sh

@@ -16,18 +16,21 @@ if ! docker inspect gitea >/dev/null 2>&1; then
     exit 1
 fi
 
-# Ensure backup directory exists inside gitea container
-docker exec -u git gitea sh -c "mkdir -p /tmp/backup"
-
-# Run gitea dump
+# Run gitea dump to /tmp (writable by git user)
 echo "Running gitea dump..."
 docker exec -u git -w /tmp gitea \
     /app/gitea/gitea dump \
     -c /data/gitea/conf/app.ini \
-    --file "/tmp/backup/${BACKUP_FILE}" \
+    --file "/tmp/${BACKUP_FILE}" \
     --skip-log \
     --type zip
 
+# Copy dump out of gitea container into sidecar's backup dir
+docker cp "gitea:/tmp/${BACKUP_FILE}" "${BACKUP_DIR}/${BACKUP_FILE}"
+
+# Clean up temp file inside gitea container
+docker exec gitea rm -f "/tmp/${BACKUP_FILE}"
+
 # Verify backup was created
 if [ ! -f "${BACKUP_DIR}/${BACKUP_FILE}" ]; then
     echo "ERROR: Backup file not found at ${BACKUP_DIR}/${BACKUP_FILE}"