Ships every completed backup off-box over WebDAV via rclone, verified by exact byte-size match before local retention or schedule rotation ever touches it. Fixes prune_orphans to skip confirmed-offloaded backups whose local copy was already purged (it previously hard-deleted their DB row, discarding the only pointer to the remote copy). Installs rclone in the Docker image and gitignores the container's rclone.conf location, which lives inside the bind-mounted repo root and holds live credentials. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XjW4qocnaJxhugUi5ca8Wo