Initial commit — Donna portal v1

Setup completo del portal interno donna.aal-law.com:

* Landing público con OAuth login + grid de apps autenticado
* Flujo OAuth2 contra Mailcow (mail.aal-law.com)
* Sesiones SSO compartidas en el dominio (cookie donna_session, 8h)
* Whitelist de dominios aal-law.com / aalnlaw.com
* App "Control de Escrituras" migrada desde ZH-Consultores/control-escrituras
  (mismo schema, mismo frontend, ahora con shared Auth/Db/Config libs)
* Migraciones SQL para users, escrituras_tramites, escrituras_historial
* Caddy on :80 con rewrite extless → .php
* Backup diario MariaDB (systemd timer + script) con retención 14d
* Documentación de arquitectura en README + infra files en docs/infra

bin/donna-backup.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Donna — daily MariaDB backup with 14-day retention
+set -euo pipefail
+
+BACKUP_DIR="/var/backups/donna"
+ENV_FILE="/etc/donna/donna.env"
+RETENTION_DAYS=14
+
+# shellcheck disable=SC1090
+. <(grep -E '^(DB_NAME|DB_USER|DB_PASS|DB_HOST|DB_PORT)=' "$ENV_FILE")
+
+mkdir -p "$BACKUP_DIR"
+chmod 750 "$BACKUP_DIR"
+
+STAMP=$(date +%F_%H%M%S)
+OUT="$BACKUP_DIR/donna-$STAMP.sql.gz"
+
+MYSQL_PWD="$DB_PASS" mariadb-dump \
+    --host="${DB_HOST:-127.0.0.1}" \
+    --port="${DB_PORT:-3306}" \
+    --user="$DB_USER" \
+    --single-transaction \
+    --quick \
+    --routines \
+    --triggers \
+    --events \
+    --default-character-set=utf8mb4 \
+    "$DB_NAME" \
+    | gzip -9 > "$OUT"
+
+chmod 640 "$OUT"
+
+find "$BACKUP_DIR" -type f -name 'donna-*.sql.gz' -mtime "+$RETENTION_DAYS" -delete
+
+echo "[donna-backup] $(date -Is) wrote $OUT ($(du -h "$OUT" | cut -f1))"