Add standalone backup script and admin update-check banner

ops/backup.sh snapshots LDAP (slapcat), Redis (BGSAVE, dynamic RDB path
lookup), and ./config for standalone deployments, with retention. A
background service polls GitHub releases every 24h and surfaces an
admin-only banner in the UI when a newer version is published.

DEPLOYMENT.md

@@ -251,9 +251,21 @@ proxy and a natural fit — it's both an **OIDC client** of the SSO Manager *and
 **Automatic snapshots** — when run as part of the unified `theta-env` stack,
 `setup.sh` snapshots LDAP + Redis + `./config/` to `./backups/<timestamp>/`
 before every rebuild and keeps the last `BACKUP_KEEP` (default 5). Standalone
-deployments don't get this; use the manual steps below.
+deployments should run `ops/backup.sh` the same way (on a cron/systemd timer,
+or by hand before an upgrade):
 
-**Manual backup**
+```bash
+./ops/backup.sh              # keeps the last 5 by default
+./ops/backup.sh 10           # or override retention
+BACKUP_KEEP=10 ./ops/backup.sh
+```
+
+It snapshots LDAP (`slapcat`, auto-detecting your base DN from
+`./config/sso-secrets.js`), Redis (`BGSAVE`, falling back to a synchronous
+`SAVE` if that doesn't complete quickly), and `./config/` to
+`./backups/<timestamp>/`, pruning older backups beyond the retention count —
+the same approach `theta-env`'s `setup.sh` uses, just scoped to this one
+container. Equivalent manual steps, if you'd rather not use the script:
 
 ```bash
 # LDAP — full directory export (works while slapd is running)
@@ -267,8 +279,8 @@ docker compose cp sso-manager:/data/dump.rdb sso-redis-$(date +%F).rdb
 # Secrets — copy the config dir (holds LDAP_ADMIN_PASS, JWT secret, etc.)
 cp -a ./config config-backup-$(date +%F) && chmod 700 config-backup-$(date +%F)
 ```
-Store the `.ldif`, `.rdb`, and config copy **off the host** — they contain
-secrets and the whole user directory.
+Store the backup **off the host** — it contains secrets and the whole user
+directory.
 
 **Restore — full (disaster recovery)**