Replace inline LITESTREAM_R2_* credentials in the backup service with the named [r2-landing] rclone remote and R2_LANDING_* env vars, matching the beanflows pattern. Add rclone.conf setup to bootstrap_supervisor.sh so the remote is written from env on each bootstrap run. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>