feat(tools): remote <ziel> <aktion> als Vordertuer zum Server (D77-Nachtrag)

Deployen, Log ansehen, Dienst schalten und fragen was laeuft waren vier
verschiedene Beschwoerungen, drei davon von Hand als ssh + systemctl. Jetzt:

  remote backend deploy|upload|setup|install-jdk|reset-password
  remote backend start|stop|restart|status|enable|disable
  remote backend log|info|documents|backup
  remote frontend deploy|preview|info
  remote ssh

Die Skripte unter scripts/ bleiben die Implementierung und einzeln aufrufbar;
tools/remote bringt nur mit, wofuer es bisher nichts gab. Wo ein Schalter
noetig war, kam er ins Skript statt ins Werkzeug: --unit-only in
deploy-backend.sh (sonst kennte eine zweite Stelle die Unit-Platzhalter) und
--dry-run in deploy-prod.sh, das die Befoerderung ausdruecklich mit abschaltet.

Neu ist die Sicherung: H2 haelt die Datei offen, also anhalten, holen, wieder
starten (gemessen ~8 s Auszeit) - und das Archiv lesen, bevor der Befehl es
behaelt. Gegenprobe von Hand: lokal ausgepackt, Backend mit --werkbaum.data-dir
dagegen gestartet, es liefert genau die Dokumente des Servers.

.envrc legt tools/ auf den PATH (direnv), 217 Plan-Knoten, 0 Warnungen.

docs/examples/werkbaum.werkbaum

@@ -107,10 +107,12 @@
       - [^] #bld.pwa.sw: A service worker that serves the app offline (S)  %% network-first, cache as fallback
       - [^] #bld.pwa.update: The reload notice stays truthful under the worker (S)  %% see D45/D73
       - [^] #bld.pwa.files: Double-click a .werkbaum file, save without any dialog (S) :#ed.files.inplace  %% file_handlers + launchQueue
-    - [^] #bld.backend: Ship the backend as a service of its own (M)
+    - [^] #bld.backend: Ship the backend as a service of its own (L)
       - [^] #bld.backend.jdk: Its own JDK 21 in the server's home (S)  %% only 17 is installed there
       - [^] #bld.backend.unit: A systemd user unit that survives the session (S)
       - [^] #bld.backend.proxy: Apache passes /api/ on, in .htaccess (XS)  %% measured: the P flag is allowed
+      - [x] #bld.backend.remote: One command for everything on the server (S)  %% remote <target> <action>
+      - [x] #bld.backend.backup: Save the database, and prove it can be read back (XS)
     - [-] #bld.ghpages: Deploy through a gh-pages branch (S)  %% GitHub Actions instead
     - [-] #bld.gfonts: Fonts from Google (XS)  %% self-hosted, no third-party request
   - [ ] #be: Backend (XL)
@@ -749,6 +751,16 @@
   .htaccess and the vhost directory is out of reach. Measured on the target: a
   request is held open for 30 seconds, which is what the change feed needs.
 
+#bld.backend.remote
+  Deploying, reading the log, asking what is running and switching the service
+  were four different incantations, three of them typed by hand as ssh plus
+  systemctl. One front door names them all as target and action.
+
+#bld.backend.backup
+  The database is a file in a home directory, and H2 holds it open, so a copy
+  taken while the service runs can be torn. Stop, fetch, start again — and read
+  the archive back before trusting it.
+
 #bld.ghpages
   Rejected: the official Actions route needs no extra branch and no deploy
   key.