fix: move cloud backup keys and scripts out of container volume paths

SSH keys moved to /etc/ssh/backup_keys/ (ssh_home_t) and backup scripts
to /usr/local/bin/ (bin_t) to fix SELinux denials - container_file_t
context blocked rsync from exec'ing ssh. Also fixes skudak key path
mismatch (was truenas_skudak, key deployed as truenas_skudak-cloud).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ansible/roles/podman/tasks/containers/cloud-backup.yml

@@ -1,12 +1,22 @@
 ---
+- name: create backup SSH key directory
+  become: true
+  ansible.builtin.file:
+    path: /etc/ssh/backup_keys
+    state: directory
+    owner: root
+    group: root
+    mode: 0700
+
 - name: deploy {{ backup_name }} backup SSH key
   become: true
   ansible.builtin.copy:
     content: "{{ ssh_key_content }}"
-    dest: "/root/.ssh/truenas_{{ backup_name }}"
+    dest: "{{ ssh_key_path }}"
     owner: root
     group: root
     mode: 0600
+    setype: ssh_home_t
 
 - name: template {{ backup_name }} backup script
   become: true
@@ -16,6 +26,7 @@
     owner: root
     group: root
     mode: 0755
+    setype: bin_t
 
 - name: template {{ backup_name }} backup systemd service
   become: true