feat: harden storyforge production baseline

scripts/backup_storyforge_sqlite.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+DATABASE_PATH="${DATABASE_PATH:-$ROOT_DIR/data/collector/storyforge.db}"
+BACKUP_DIR="${BACKUP_DIR:-$ROOT_DIR/data/backups}"
+TIMESTAMP="$(date -u +%Y%m%dT%H%M%SZ)"
+TARGET_PATH="$BACKUP_DIR/storyforge-${TIMESTAMP}.db"
+
+mkdir -p "$BACKUP_DIR"
+
+python3 - "$DATABASE_PATH" "$TARGET_PATH" <<'PY'
+from __future__ import annotations
+
+import pathlib
+import sqlite3
+import sys
+
+source_path = pathlib.Path(sys.argv[1])
+target_path = pathlib.Path(sys.argv[2])
+
+if not source_path.exists():
+    raise SystemExit(f"source database not found: {source_path}")
+
+target_path.parent.mkdir(parents=True, exist_ok=True)
+
+with sqlite3.connect(source_path) as source_conn, sqlite3.connect(target_path) as target_conn:
+    source_conn.backup(target_conn)
+
+print(target_path)
+PY