fix(web): backup directory permissions, prevent recurrence

/var/lib/ci/backups was root:root because ci-backup-template.service
runs as root and mkdir(exist_ok=True) created it before ci-runner ever
touched it, so every 7z backup failed with errno=13. Chown to
ci-runner:ci-runner + 750, and stop the drift from coming back: the
setup script now creates+chmods the dir, and the systemd unit gets an
ExecStartPre that (re)installs it with the right owner on every start.

setup-host-linux.sh

@@ -196,13 +196,13 @@ for pkg in p7zip-full xorriso genisoimage; do
 done
 
 mkdir -p \
-    "$CI_ROOT"/{build-vms,artifacts,templates,keys,logs,runner,iso} \
+    "$CI_ROOT"/{build-vms,artifacts,templates,backups,keys,logs,runner,iso} \
     "$OPT_CI" \
     /etc/ci/keys
 
 chown -R "$CI_USER:$CI_USER" "$CI_ROOT" "$OPT_CI"
 chmod 750 "$CI_ROOT" "$OPT_CI"
-for d in build-vms artifacts templates keys logs runner iso; do
+for d in build-vms artifacts templates backups keys logs runner iso; do
     chmod 750 "$CI_ROOT/$d"
 done
 chmod 700 /etc/ci/keys