Initial scaffold: Borg engine + docs (Layer 1 milestone)

apiscp-borg is a sibling of apiscp-kopia built on BorgBackup. This first
milestone lands the project scaffold and the Layer 1 engine:
- borg-apiscp-backup: per-site named archives (siteN-shadow/info/db), fresh
  per-site DB dumps via ApisCP site-context export, system + custom archives,
  borg prune retention per prefix, Prometheus metrics, email notifications.
- apiscp-borg-common.sh: logging, mail, site/owner helpers.
- config example, systemd service+timer, install.sh, README, DESIGN.

Borg preserves POSIX ACLs and xattrs natively, so (unlike the kopia engine) no
metadata sidecar is required; DESIGN.md records how Borg reshapes the design.
Repository/restore tools, Layer 2 panel integration, hooks, uninstall, and the
full reference are the next milestones.

etc/apiscp-borg.config.example

@@ -0,0 +1,75 @@
+# apiscp-borg configuration. Copy to /etc/apiscp-borg/config (root-owned, 0600:
+# it holds the repository passphrase). All keys have sane defaults so the engine
+# also runs on a stock ApisCP box once BORG_REPO and BORG_PASSPHRASE are set.
+#
+# This file is sourced by POSIX sh. Quote values; do not add spaces around '='.
+
+# --- repository ---------------------------------------------------------------
+# Borg repository location. Either a local path or an ssh URL, e.g.:
+#   BORG_REPO="/mnt/backups/apiscp-borg"
+#   BORG_REPO="ssh://borg@backup.example.net:22/./apiscp-borg"
+BORG_REPO=""
+
+# Repository passphrase. Borg reads BORG_PASSPHRASE from the environment; the
+# engine exports whatever is set here. Keep this file 0600 and root-owned.
+# For recoverability, back it up off the machine (borg-apiscp-repo backup-key).
+BORG_PASSPHRASE=""
+
+# Encryption mode used when CREATING a new repository (repokey keeps the key in
+# the repo so only the passphrase is needed to recover). Other modes:
+# repokey-blake2 (default), keyfile-blake2 (key stored under ~/.config/borg).
+BORG_ENCRYPTION="repokey-blake2"
+
+# Extra SSH options for ssh:// repositories (e.g. a dedicated key). Passed to
+# borg via BORG_RSH.
+BORG_RSH="ssh -o BatchMode=yes"
+
+# Where the one-time key/passphrase backup is written (store a copy off-machine).
+KEY_BACKUP_DIR="/root/apiscp-borg-keys"
+
+# --- what to back up ----------------------------------------------------------
+# "all" (default), "none", or a comma-separated list of site ids (site1,site3).
+BACKUP_SITES="all"
+# Back up the shared system paths (1, default) or skip them (0).
+BACKUP_SYSTEM="1"
+# Dump and archive per-site databases via ApisCP's site-context export (1) or
+# skip (0).
+BACKUP_DATABASES="1"
+# Extra absolute paths to back up, comma or space separated (default none).
+BACKUP_PATHS=""
+# Shared system paths and globs (space separated).
+SYSTEM_PATHS="/etc /opt"
+SYSTEM_GLOBS="/var/log/mailer_table* /var/lib/mysql/mysql-grants* /var/lib/pgsql/*/backups /root/apnscp* /root/license*"
+# Comma-separated Borg exclude patterns (globs). The in-site restore staging dir
+# /.borg-restore is always excluded.
+BACKUP_EXCLUDES=""
+
+# --- retention (borg prune, applied after each run) ---------------------------
+# Blank means "no limit" for that bucket. Applied per site archive prefix.
+RETENTION_KEEP_WITHIN=""
+RETENTION_KEEP_DAILY=""
+RETENTION_KEEP_WEEKLY=""
+RETENTION_KEEP_MONTHLY=""
+RETENTION_KEEP_ANNUAL=""
+
+# --- schedule -----------------------------------------------------------------
+# HH:MM for a daily run, or a full systemd OnCalendar expression. Managed via
+# the panel or borg-apiscp-repo set-schedule (writes a timer drop-in).
+BACKUP_SCHEDULE="03:30"
+
+# --- notifications ------------------------------------------------------------
+# Email a report of each run. NOTIFY_EMAIL empty disables it. NOTIFY_ON is
+# "failure" (default), "always", or "never". NOTIFY_FROM overrides the sender.
+NOTIFY_EMAIL=""
+NOTIFY_ON="failure"
+NOTIFY_FROM=""
+
+# --- engine internals ---------------------------------------------------------
+VIRTBASE="/home/virtual"
+STAGE="/var/lib/apiscp-borg"
+METRICS_DIR=""
+RUN_DB_EXPORT="1"
+APNSCP_CMD="/usr/local/apnscp/bin/cmd"
+# Optionally also capture ACL/xattr text sidecars (Borg already preserves them
+# natively, so this is off by default).
+CAPTURE_META_SIDECAR="0"