Endpoint telemetry, PC Detail rework and a checked backup/restore path

scripts/backup/Dockerfile.backup

@@ -0,0 +1,53 @@
+# Backup sidecar image: mysql:8.4 (for a version-matched mysqldump) plus restic
+# (for deduped, encrypted, destination-agnostic file snapshots) and a small
+# Python for the manifest writer.
+#
+# WHY mysql:8.4 as the base: the dump tool must match the server major/minor so
+# the SQL it emits restores cleanly onto the same engine. Reusing the exact
+# image the db service runs removes version drift as a failure mode.
+FROM mysql:8.4
+
+# Track 1 local build unblock: trust the corporate proxy (Zscaler/GE) root CA so
+# the build-time fetches below (Oracle yum, github.com, PyPI) succeed behind TLS
+# interception. This is a local convenience only; the shipping build vendors
+# these deps instead of fetching them (pinned restic + SHA256, vendored
+# bzip2/python3/alembic or a base image that carries them) so the release image
+# needs no outbound calls and no embedded cert. The cert is gitignored (*.pem)
+# and must be staged at scripts/backup/zscaler-root-ca.pem before building.
+#
+# Copied via the directory rather than by name, because the cert is OPTIONAL: it
+# is gitignored, so a plain `COPY scripts/backup/zscaler-root-ca.pem` fails the
+# build outright and nobody outside a TLS-intercepting network - another site,
+# or our own CI - could build this image at all. A trailing glob does not fix
+# that either: BuildKit fails a COPY whose pattern matches nothing, which is
+# precisely the case being handled. Copying a directory that always exists and
+# testing for the file inside it is the form that works both ways.
+COPY scripts/backup/ /tmp/buildctx/
+RUN if [ -f /tmp/buildctx/zscaler-root-ca.pem ]; then \
+		echo "staging corporate root CA"; \
+		cp /tmp/buildctx/zscaler-root-ca.pem /etc/pki/ca-trust/source/anchors/; \
+		update-ca-trust; \
+	else \
+		echo "no corporate root CA staged - using the public trust store"; \
+	fi \
+	&& rm -rf /tmp/buildctx
+
+# restic from the distro is often stale; pull the pinned release binary so the
+# snapshot format and retention flags are predictable across sites.
+ARG RESTIC_VERSION=0.17.3
+RUN microdnf install -y bzip2 python3 python3-pip ca-certificates \
+	&& curl -fsSL -o /tmp/restic.bz2 \
+		"https://github.com/restic/restic/releases/download/v${RESTIC_VERSION}/restic_${RESTIC_VERSION}_linux_amd64.bz2" \
+	&& bunzip2 /tmp/restic.bz2 \
+	&& install -m 0755 /tmp/restic /usr/local/bin/restic \
+	&& rm -f /tmp/restic \
+	&& microdnf clean all
+
+# alembic so the manifest writer can read the current schema head. pip does not
+# read the system trust store, so point it at the extracted system CA bundle
+# (now including the proxy root) to get through TLS interception.
+RUN python3 -m pip install --no-cache-dir \
+	--cert /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \
+	alembic
+
+ENTRYPOINT ["/opt/backup/backup.sh"]