Harden backup integrity, implement verified restore and safe upgrades

logrotate/app-backup

@@ -1,9 +1,5 @@
-/var/log/app-backup/*.log {
-    daily
-    rotate 7
-    missingok
-    notifempty
-    compress
-    delaycompress
-    create 0640 root root
-}
+# app-backup v2 writes one private log per run. Successful backups remove v2
+# logs older than LOG_RETENTION_DAYS; journald has its own system-wide policy.
+# Historic v1 app-backup_*.log / rclone_*.log files are retained for manual review.
+# No rotating rule: rotating an already completed run leaves empty successors
+# and can prevent maxage cleanup when notifempty is used.