fleet-manager: pull non-CI images through the Harbor mirror

Route the ad-hoc images I introduced through harbor.bitasylum.org (the standing
rule): backup.sh uses harbor.bitasylum.org/dockerhub/library/alpine:3.20 (via an
overridable ALPINE_IMAGE); the DEPLOY.md volume-chown fix + the goacme/lego prose
use the Harbor paths too. Compose (influxdb/traefik) + Dockerfile bases are already
harbor-mirrored; git.bitasylum.org/audiobuzz/* stays (CI-built).

serving/fleet-manager/backup.sh

@@ -14,7 +14,8 @@
 #   COMPOSE_PROJECT_NAME=foo ./backup.sh   # if you run compose under another project
 #
 # Restore (manager stopped):
-#   docker run --rm -v <project>_fleet-data:/dest -v "$PWD/backups":/src alpine \
+#   docker run --rm -v <project>_fleet-data:/dest -v "$PWD/backups":/src \
+#     harbor.bitasylum.org/dockerhub/library/alpine:3.20 \
 #     sh -c 'rm -rf /dest/* && tar xzf /src/fleet-data-YYYYmmdd-HHMMSS.tar.gz -C /dest'
 set -euo pipefail
 
@@ -22,6 +23,8 @@ DEST=${1:-./backups}
 PROJECT=${COMPOSE_PROJECT_NAME:-fleet-manager}   # compose derives volume names as <project>_<key>
 STAMP=$(date -u +%Y%m%d-%H%M%S)
 VOLUMES=${BACKUP_VOLUMES:-"fleet-data influx-data"}
+# Non-CI images pull through the Harbor mirror; overridable for other registries.
+ALPINE_IMAGE=${ALPINE_IMAGE:-harbor.bitasylum.org/dockerhub/library/alpine:3.20}
 
 mkdir -p "$DEST"
 DEST_ABS=$(cd "$DEST" && pwd)
@@ -37,7 +40,7 @@ for key in $VOLUMES; do
     docker run --rm \
         -v "${vol}:/src:ro" \
         -v "${DEST_ABS}:/backup" \
-        alpine tar czf "/backup/${out}" -C /src .
+        "$ALPINE_IMAGE" tar czf "/backup/${out}" -C /src .
 done
 
 # Retention: keep the newest $KEEP of each volume's tarballs (0 = keep all).