fix: move cloud backup keys and scripts out of container volume paths

SSH keys moved to /etc/ssh/backup_keys/ (ssh_home_t) and backup scripts
to /usr/local/bin/ (bin_t) to fix SELinux denials - container_file_t
context blocked rsync from exec'ing ssh. Also fixes skudak key path
mismatch (was truenas_skudak, key deployed as truenas_skudak-cloud).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ansible/roles/podman/tasks/containers/cloud-backup.yml

@@ -1,12 +1,22 @@
 ---
+- name: create backup SSH key directory
+  become: true
+  ansible.builtin.file:
+    path: /etc/ssh/backup_keys
+    state: directory
+    owner: root
+    group: root
+    mode: 0700
+
 - name: deploy {{ backup_name }} backup SSH key
   become: true
   ansible.builtin.copy:
     content: "{{ ssh_key_content }}"
-    dest: "/root/.ssh/truenas_{{ backup_name }}"
+    dest: "{{ ssh_key_path }}"
     owner: root
     group: root
     mode: 0600
+    setype: ssh_home_t
 
 - name: template {{ backup_name }} backup script
   become: true
@@ -16,6 +26,7 @@
     owner: root
     group: root
     mode: 0755
+    setype: bin_t
 
 - name: template {{ backup_name }} backup systemd service
   become: true

ansible/roles/podman/tasks/containers/home/cloud.yml

@@ -88,8 +88,8 @@
   vars:
     backup_name: cloud
     data_path: "{{ cloud_path }}/data"
-    ssh_key_path: /root/.ssh/truenas_cloud
+    ssh_key_path: /etc/ssh/backup_keys/cloud
     ssh_key_content: "{{ cloud_backup_ssh_key }}"
     ssh_user: cloud
     remote_path: /mnt/glacier/nextcloud
-    script_path: "{{ cloud_path }}/backup.sh"
+    script_path: /usr/local/bin/cloud-backup.sh

ansible/roles/podman/tasks/containers/skudak/cloud.yml

@@ -135,8 +135,8 @@
   vars:
     backup_name: skudak-cloud
     data_path: "{{ cloud_skudak_path }}/data"
-    ssh_key_path: /root/.ssh/truenas_skudak
+    ssh_key_path: /etc/ssh/backup_keys/skudak-cloud
     ssh_key_content: "{{ cloud_skudak_backup_ssh_key }}"
     ssh_user: skucloud
     remote_path: /mnt/glacier/skudakcloud
-    script_path: "{{ cloud_skudak_path }}/backup.sh"
+    script_path: /usr/local/bin/skudak-cloud-backup.sh