Backup: switch NAS transport to SMB/CIFS, fix crond/OOM/live-tar defects

Wire the backup service against the Synology share over SMB/CIFS (the NAS
authenticates with a user/password; NFS is IP-allowlist only). Also fixes
three defects found bringing the service up live:

- entrypoint crash-loop: dcron's crond fails "setpgid: Operation not
  permitted" in this runtime -> use busybox crond; make repo-init idempotent
  (check via `restic cat config`, tolerate init-on-existing) so a transient
  CIFS/lock hiccup can't kill PID 1.
- OOM: pg_dump of a ~276MB DB + tar + restic exceeded the 256M cap -> 1G.
- live tar abort: GNU tar exits 1 when TDLib files change mid-read (worker is
  live); per design this is best-effort, so tolerate exit 1, fatal only >=2.

Kuma push is now optional (empty URL disables alerting) since it's deferred.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -109,7 +109,7 @@ services:
       - POSTGRES_DB=${POSTGRES_DB:-dragonsstash}
       - RESTIC_REPOSITORY=/backups/restic-repo
       - RESTIC_PASSWORD=${RESTIC_PASSWORD:?Set RESTIC_PASSWORD in .env}
-      - KUMA_PUSH_URL=${KUMA_PUSH_URL:?Set KUMA_PUSH_URL in .env}
+      - KUMA_PUSH_URL=${KUMA_PUSH_URL:-}
       - TZ=${TZ:-Etc/UTC}
     volumes:
       - tdlib_state:/data/tdlib-worker:ro
@@ -122,7 +122,7 @@ services:
     deploy:
       resources:
         limits:
-          memory: 256M
+          memory: 1G
     networks:
       - backend
 
@@ -158,9 +158,9 @@ volumes:
   manual_uploads:
   nas_backups:
     driver_opts:
-      type: nfs
-      o: "addr=${NAS_HOST},rw,nfsvers=4,soft,timeo=100"
-      device: ":${NAS_EXPORT_PATH}"
+      type: cifs
+      o: "username=${NAS_USERNAME},password=${NAS_PASSWORD},vers=3.0,uid=0,gid=0,file_mode=0660,dir_mode=0770"
+      device: "//${NAS_HOST}/${NAS_SHARE}"
 
 networks:
   frontend: