feat(backup): file-capture labels for linkding, vaultwarden, headscale, mastodon

Now that uid auto-discover is in (d424473), adding more apps is just naming the
container + path — no uid guessing. Four more apps get complete backups of their
private data dirs (previously: incomplete on the file side because libreportal
can't read sub-UID-owned content from the host).

- linkding-service     -> /etc/linkding/data           (overlaps with sqlite db, same pattern as gitea — dump replays over the captured tree on restore, harmless)
- vaultwarden-service  -> /data                         (same overlap pattern)
- headscale-service    -> /var/lib/headscale            (same overlap pattern)
- mastodon-service     -> /mastodon/public/system       (uploads; postgres handled separately by backup.db)

Coverage now: nextcloud, bookstack, gitea, owncloud, linkding, vaultwarden,
headscale, mastodon. Skipped jellyfin — it has multiple internal sqlite DBs and
no backup.db declared; adding just backup.files without backup.db / backup.live
wouldn't activate live capture, and adding backup.live blind could yield torn
sqlites. That one wants proper DB declaration first.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: librelad <librelad@digitalangels.vip>

containers/headscale/docker-compose.yml

@@ -21,6 +21,7 @@ services:
       libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
       libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
       libreportal.backup.db: "sqlite:::data/db.sqlite"
+      libreportal.backup.files: "headscale-service:/var/lib/headscale:data"
     healthcheck:
       disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
     # GLUETUN_OFF_BEGIN

containers/linkding/docker-compose.yml

@@ -19,6 +19,7 @@ services:
             libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
             libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
             libreportal.backup.db: "sqlite:::data/db.sqlite3"
+            libreportal.backup.files: "linkding-service:/etc/linkding/data:data"
             traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
             # TRAEFIK_PORT_1_BEGIN
             traefik.http.routers.linkding-service.entrypoints: web,websecure

containers/mastodon/docker-compose.yml

@@ -37,6 +37,7 @@ services:
             libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
             libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
             libreportal.backup.db: "postgres:mastodon-postgres:postgres:"
+            libreportal.backup.files: "mastodon-service:/mastodon/public/system:mastodon_data"
             traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
             # TRAEFIK_PORT_1_BEGIN
             traefik.http.routers.mastodon-service.entrypoints: web,websecure

containers/vaultwarden/docker-compose.yml

@@ -26,6 +26,7 @@ services:
       libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
       libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
       libreportal.backup.db: "sqlite:::vaultwarden-data/db.sqlite3"
+      libreportal.backup.files: "vaultwarden-service:/data:vaultwarden-data"
       traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
       # TRAEFIK_PORT_1_BEGIN
       traefik.http.routers.vaultwarden-service.entrypoints: web,websecure