docs(rclone): LXC 132 rclone -> Proton Drive backup; deprecate restic-on-USB

New off-host backup job replacing the disabled restic-on-USB backup: LXC 132
`rclone` mirrors selected /mnt/library folders to Proton Drive (plain rclone
sync, Proton's built-in E2E, no crypt overlay) on a monthly timer, with
rclone's Web GUI for LAN-only browsing/ad-hoc runs and live job status.

- containers/132-rclone.md: full design, Proton auth gotcha (TOTP secret vs
  live code), pct exec PATH gotcha, rc-API job-visibility runner rewrite,
  selected folder set (cloud/documents/repos), deferred tracked-repo note.
- infrastructure/backups.md: restic-on-USB marked DEPRECATED/superseded,
  leads with the new job now.
- containers/index.md, README.md, infrastructure/media-permissions.md:
  register the new container.

infrastructure/backups.md

@@ -1,4 +1,28 @@
-# Backups — restic on external drive (DISABLED)
+# Backups — restic on external drive (DEPRECATED — superseded)
+
+> **DEPRECATED 2026-07-01.** Superseded by the **rclone → Proton Drive** off-host mirror on
+> [LXC 132 `rclone`](../containers/132-rclone.md). That job finally closes the off-host / 3-2-1 gap
+> this page flagged for months. The restic-on-USB job below is kept for archaeology; it has been
+> **DISABLED since 2026-04-22** and is not coming back in its old form.
+
+## Current backup — rclone → Proton Drive (LXC 132)
+
+- **Where:** [LXC 132 `rclone`](../containers/132-rclone.md) (`192.168.8.214`), `/mnt/library`
+  mounted **read-only**.
+- **What:** plain `rclone sync` (Proton mirrors local; browsable files, no versioning) of the
+  folders listed in `/etc/rclone-backup/folders.list`, to `proton:library-backup/…`.
+- **When:** monthly — `rclone-backup.timer` (`OnCalendar=*-*-01 03:00`).
+- **UI:** rclone Web GUI on `192.168.8.214:5572` (LAN-only, no auth).
+- **Encryption:** Proton's built-in E2E (no rclone `crypt` overlay).
+- **Runs / logs:** `/var/log/rclone-backup/` + `runs.jsonl`.
+- **Still a single off-host target** (Proton only). Not yet a full 3-2-1 (no second independent
+  copy), but strictly better than the previous "no off-host copy at all."
+
+See [132-rclone](../containers/132-rclone.md) for the full design.
+
+---
+
+## Legacy — restic on external drive (DISABLED 2026-04-22)
 
 Chunked monthly restic backup of `/mnt/library`'s irreplaceable subset. **Disabled 2026-04-22** as part of the [hubris crash-loop A/B test](../investigations/2026-04-21-hubris-crash-loop.md).
 
@@ -81,7 +105,7 @@ Runbook at `/usr/share/doc/backup-library/RECOVERY.md` (or in the repo at `doc/R
 
 ## Known SPOF
 
-Single drive. RECOVERY.md flags the 3-2-1 gap. Mitigations (second drive, cloud repo via `restic copy`) are not yet implemented.
+Single drive. RECOVERY.md flags the 3-2-1 gap. Mitigations (second drive, cloud repo via `restic copy`) were not implemented before this job was retired — the **off-host copy is now provided by [rclone → Proton Drive (LXC 132)](../containers/132-rclone.md)** instead. A second independent copy is still outstanding.
 
 ## Drive history
 
@@ -102,6 +126,9 @@ Moved out of this repo to `dtoro/claudio-monitor` on 2026-04-21 (commit `50dc213
 
 ## Changelog
 
+### 2026-07-01 — DEPRECATED; superseded by rclone → Proton Drive (LXC 132)
+Off-host backup moved to a plain `rclone sync` mirror on the new [LXC 132 `rclone`](../containers/132-rclone.md) (`/mnt/library` → Proton Drive, monthly, LAN Web GUI). This finally provides the off-host copy the "Known SPOF" note wanted. The restic-on-USB units on hubris remain `disabled` (drive already removed 2026-04-22); page restructured to lead with the current job and demote restic to "Legacy".
+
 ### 2026-04-28 — wiki entry created
 Initial documentation. Status remains DISABLED.
 

infrastructure/media-permissions.md

@@ -62,6 +62,7 @@ Every LXC that mounts `/mnt/library` participates in a shared `media` group with
 | 120 | [mule-images](../containers/120-mule-images.md) | priv | www-data                                    |
 | 122 | [arriman](../containers/122-arriman.md)       | priv | www-data, audiobookshelf, radarr, sonarr, lidarr, prowlarr, qbittorrent, bazarr, jellyseerr, mylar, jackett, overseerr, plex, arr |
 | 130 | [grimmory](../containers/130-grimmory.md)     | priv | Docker container uses `GROUP_ID=10000` env var (linuxserver pattern) — no in-LXC group needed |
+| 132 | [rclone](../containers/132-rclone.md)         | priv | **read-only** mount; runs as root → reads all subtrees. No media group needed |
 
 > Some entries from earlier snapshots — 100 (arr-yunohost), 107 (marimo), 109 (syncthing), 110 (photoprism), 112 (immich), 116 (heaper) — referenced LXCs that have since been destroyed. See [containers/index](../containers/index.md#recently-destroyed-kept-for-archaeology).