feat(v0.3.0): weekly snapshots, incremental replication, auth, uptime, hardening

- snapshot: implement weekly ZFS snapshots (Sunday midnight, retain_weekly config)
- snapshot: incremental cold replication via zfs send -i; tracks last replicated
  snapshot in /var/lib/claw-store/last-replicated-snapshot
- daemon: write start-time file for uptime reporting; add SIGTERM graceful shutdown
- serve: daemon_uptime_secs now reads the start-time file (was hardcoded 0)
- serve: validate project names in POST handlers (org/repo slug, no traversal)
- serve: Bearer token auth middleware on all POST endpoints via cfg.api_token
- config: add optional api_token field (backward compatible, defaults to None)
- sync: add SSH timeouts (ConnectTimeout=10, ServerAliveInterval=5) to peer notify
- hot/sync/main: replace unwrap() on path-to-str with proper anyhow errors
- config/tank.toml: document 10G fabric IP and nightly_at field intent
- .gitignore: exclude compiled dashboard assets (claw-store/static/)
- Makefile: add build, install, install-systemd, install-dashboard, deploy targets
- tests: 29 passing (up from 25); 4 new weekly snapshot tests

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

claw-store/src/config.rs

@@ -59,6 +59,11 @@ pub struct Config {
     pub cold: Option<ColdConfig>,
     pub replication: Option<ReplicationConfig>,
     pub peer: Option<PeerConfig>,
+    /// Optional Bearer token required on all HTTP POST endpoints.
+    /// Set to a long random string, e.g. `openssl rand -hex 32`.
+    /// If absent, POST endpoints are unauthenticated (internal-network use only).
+    #[serde(default)]
+    pub api_token: Option<String>,
 }
 
 impl Config {