fix(web): backup directory permissions, prevent recurrence

/var/lib/ci/backups was root:root because ci-backup-template.service
runs as root and mkdir(exist_ok=True) created it before ci-runner ever
touched it, so every 7z backup failed with errno=13. Chown to
ci-runner:ci-runner + 750, and stop the drift from coming back: the
setup script now creates+chmods the dir, and the systemd unit gets an
ExecStartPre that (re)installs it with the right owner on every start.

deploy/systemd/ci-backup-template.service

@@ -8,6 +8,13 @@ Type=oneshot
 User=root
 EnvironmentFile=/etc/ci/environment
 WorkingDirectory=/opt/ci/local-ci-cd-system
+# This service runs as root (to restart act-runner.service via ExecStopPost),
+# but the backups dir is shared with ci-web.service, which runs as ci-runner
+# and offers a manual "backup template" action. Guarantee the dir exists owned
+# by ci-runner *before* the root-owned backup writes into it, otherwise a first
+# root run would create /var/lib/ci/backups as root:root and lock ci-runner
+# (the web UI) out with errno=13. Idempotent; -o/-g re-assert ownership.
+ExecStartPre=/usr/bin/install -d -o ci-runner -g ci-runner -m 750 /var/lib/ci/backups
 # --keep-count 1: three generations of Windows templates cost ~195 GB and the
 # archives were byte-identical between runs (the templates rarely change), so
 # the extra generations bought nothing. --exclude WinBuildTest: retired test

setup-host-linux.sh

@@ -196,13 +196,13 @@ for pkg in p7zip-full xorriso genisoimage; do
 done
 
 mkdir -p \
-    "$CI_ROOT"/{build-vms,artifacts,templates,keys,logs,runner,iso} \
+    "$CI_ROOT"/{build-vms,artifacts,templates,backups,keys,logs,runner,iso} \
     "$OPT_CI" \
     /etc/ci/keys
 
 chown -R "$CI_USER:$CI_USER" "$CI_ROOT" "$OPT_CI"
 chmod 750 "$CI_ROOT" "$OPT_CI"
-for d in build-vms artifacts templates keys logs runner iso; do
+for d in build-vms artifacts templates backups keys logs runner iso; do
     chmod 750 "$CI_ROOT/$d"
 done
 chmod 700 /etc/ci/keys