Unattended save backup via sysmodule, TLS verification, and server hardening

[dmuiX]

Adds unattended save backup, hardens the server for real deployment, and
brings the docs in line with what the code actually does.

Everything here has been run on hardware — firmware 22.5.0 with Atmosphere
1.11.2, backing up three accounts against a server behind Traefik.

Background service (the main addition)

An NRO only runs while it is open, so an app can never back up a save that
changed while you were playing. This adds a sysmodule that starts with the
console and stays resident.

It wakes every five minutes and asks one question: has any save data changed
since the last upload? If not it does nothing at all — not even opening a
socket — which is the normal case and costs a few file reads. When a game ends
it checks immediately instead of waiting out the interval. While a game runs it
stays off the save files entirely, because the game holds them open.

Backing up at boot, which the first version did, sounds reasonable and works
badly: a Switch is closed, not switched off, so reboots are weeks apart and the
module would almost never run. What triggers a backup is change, not the clock.

• Install and remove it from inside the app; the module is embedded in the
  NRO's romfs, so there is no copying files into hex-named folders by hand.
• Service log in the app reads the module's log back — a sysmodule has no
  screen, and the alternative was pulling the SD card.
• Sync logic moved out of MainScreen into sync.{hpp,cpp} so the app and the
  service run the exact same code path and cannot drift apart.

It can take the console down, and it is built to survive that

It has killed hid and am during development, each time via 2001-0132
(kernel LimitReached) — an error that names the victim, not the cause. So the
module does not rely on being correct:

• It parks its own boot2.flag before anything risky and puts it back only
  after a clean round. If it dies, the flag stays parked and the next boot
  comes up without it. A boot loop is structurally impossible rather than
  merely unlikely.
• It distinguishes "we crashed" (crash_reports, our program id in the
  filename) from "a system process died" (fatal_reports) — the two real
  incidents landed in different directories.
• A crash during a backup no longer disables it for good. Nobody watches a
  console for notifications, so a module that switched itself off would stay
  off. It backs off in steps instead — 5 min, 20, 80, capped at two hours — and
  retries on its own. Only a crash during startup, where retrying means a boot
  loop, still stands down.

The README documents the memory situation in detail, including the measurements
that refused to support a threshold: the run that killed the console had more
free pool at its low point than five runs that survived. It says so rather than
quoting a number that would look authoritative and be wrong.

It also documents a second limit that is not the pool. Adding one more resident
sysmodule alongside this one made every homebrew launch panic the console
immediately after boot — Atmosphere panic occurred!, program id
0100000000000034. That id is fatal, Atmosphère's own crash reporter, which
could not get a session for lbl to turn the backlight on and aborted; the
report decodes to 2021-0003, sm::ResultOutOfSessions. It lands in
atmosphere/fatal_errors/, while crash_reports/ and fatal_reports/ stay
empty, so the obvious places suggest nothing happened. Removing the extra
sysmodule fixed it. The README writes down how to read that report, and is
explicit that this is one A/B on one console: it shows one module too many
was enough, not that any particular module is at fault.

Client

• Verify the server certificate by default. The credentials sit in the URL and
  libcurl offers them preemptively, so without verification anyone answering
  the handshake gets the password. Private CAs go in sdmc:/uNSS/cacert.pem;
  remote.insecureSkipVerify is the last resort.
• Automatic push on launch, throttled by change rather than by a timer.
• Skip titles whose saves have not changed, decided before archiving.
• Postpone automatic backups while a game is running (pm:dmnt); the manual
  Push button stays unrestricted.
• Each account gets only its own saves. The console returns every save on the
  system when asked for a list, so all accounts were previously trying to open
  each other's — and "this account never played that game" was being reported
  as a failure, which kept a healthy round from ever recording success.

Server

• Tests for the two places where a mistake is expensive and silent: the plain
  text wire format the C++ client parses by hand, and the P → C/D
  revision transaction. Both new tests fail against the previous queries.
• Fix revision selection when timestamps collide. created_at has one-second
  resolution, and ORDER BY created_at DESC then returned the oldest row, so
  a restore could hand back a previous save. Ties now break on rowid, and the
  list and per-title lookup use the same rule so they cannot disagree.
• Add the missing uvloop dependency — main.py requested it, so the
  container crashed on startup.
• Run the container as a non-root user, publish images to ghcr.io for amd64 and
  arm64, and declare the port in the image.
• A Traefik variant with basicAuth, since the client cannot follow redirects
  and no login flow can ever complete. The stack takes the password in plain
  text and hashes it itself with bcrypt cost 12, so only one representation of
  the secret has to be maintained.

Notes

• Server responses stay plain text; the wire format is unchanged and now has
  tests pinning it.
• Shared client sources are symlinked into the sysmodule rather than copied, so
  both binaries always build from the same code.
• build-all.sh builds the module first and refreshes the copy inside the
  NRO — the NRO rule depends on the elf and nacp, never on romfs contents, so
  fixing the module and running make in client/ otherwise produced an app
  that still installed the previous one.

🤖 Generated with Claude Code

[dmuiX]

Sorry first pr version were a bit too many commits. Now its densed down to the important ones.

Is working fine on my switch as of now. Have been testing it intensively. And had some problems as you definetly must slim down the installed sysmodule otherwise it will not run. But I suppose this is standing inside the README