update: the api backs up before migrating; scripts/update.sh for compose installs

Docker only, never bare metal (owner, 2026-10-21). A new version with pending migrations backs
up first (database, voicemail, sounds, MOH) and stops if it can't (SKIP_BACKUP_BEFORE_MIGRATE
to override). update.sh: checks, changelog, backup (node dist/backup-cli.js), log compaction,
build while the old version runs, restart, self-check, and rollback with restore. Container
logs capped in compose. Admin guide: Updating, for compose and Portainer.

apps/api/src/backup-cli.ts

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// `node dist/backup-cli.js` in the api container: one backup like the one before migrating
+// (database, voicemail, custom sounds, music on hold; no recordings), its file name printed.
+// scripts/update.sh runs it in the running (old) api before updating.
+import { loadConfig } from './config.ts';
+import { createDb } from './db/client.ts';
+import { backupBeforeMigrate } from './services/backup.ts';
+
+const config = loadConfig();
+const { db, pool } = createDb(config.DATABASE_URL);
+try {
+  console.log((await backupBeforeMigrate(config, db)).name);
+} finally {
+  await pool.end();
+}