fix(infra): switch landing backup to shared r2-landing rclone remote

Replace inline LITESTREAM_R2_* credentials in the backup service with
the named [r2-landing] rclone remote and R2_LANDING_* env vars, matching
the beanflows pattern. Add rclone.conf setup to bootstrap_supervisor.sh
so the remote is written from env on each bootstrap run.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infra/landing-backup/padelnomics-landing-backup.service

@@ -7,15 +7,5 @@ Wants=network-online.target
 Type=oneshot
 User=padelnomics_service
 EnvironmentFile=/opt/padelnomics/.env
-Environment=LANDING_DIR=/data/padelnomics/landing
-ExecStart=/usr/bin/rclone sync ${LANDING_DIR} :s3:${LITESTREAM_R2_BUCKET}/padelnomics/landing \
-    --s3-provider Cloudflare \
-    --s3-access-key-id ${LITESTREAM_R2_ACCESS_KEY_ID} \
-    --s3-secret-access-key ${LITESTREAM_R2_SECRET_ACCESS_KEY} \
-    --s3-endpoint https://${LITESTREAM_R2_ENDPOINT} \
-    --s3-no-check-bucket \
-    --exclude ".state.sqlite*"
-
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=padelnomics-landing-backup
+ExecStart=/bin/sh -c 'exec /usr/bin/rclone sync /data/padelnomics/landing/ r2-landing:${R2_LANDING_BUCKET}/padelnomics/ --log-level INFO --exclude ".state.sqlite*"'
+TimeoutStartSec=1800