Dockerfile: install openssh-client — rsync cannot exec ssh without it

The off-box push failed with 'rsync: Failed to exec ssh: No such file or
directory (2)'. The container had rsync and pg_dump from S62 but no ssh
binary, and rsync shells out to ssh for every remote transport. The dump
itself succeeded, so this failed AFTER a good backup and reads like a
network/auth problem when it is a missing package.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SmNjJAwEnqHPtXbvSZR8kA

Dockerfile

@@ -27,10 +27,14 @@ FROM node:20-alpine AS runner
 WORKDIR /app
 
 # curl — /api/health smoke check (Coolify HEALTHCHECK).
-# postgresql-client (pg_dump/pg_restore) + rsync + bash — the nightly DB backup
+# postgresql-client (pg_dump/pg_restore) + rsync + openssh-client + bash — the
+# nightly DB backup. openssh-client (Session 64) is NOT optional: rsync shells
+# out to `ssh` for any remote transport, and without it the off-box push dies
+# with "Failed to exec ssh: No such file or directory" AFTER a successful dump —
+# which reads like a network problem and isn't one.
 # (scripts/backup-db.sh) runs INSIDE this container, where SUPABASE_DB_URL and
 # the Supabase network are available. See docs/BACKUP-RUNBOOK.md.
-RUN apk add --no-cache curl tini bash postgresql-client rsync
+RUN apk add --no-cache curl tini bash postgresql-client rsync openssh-client
 
 # PM2 is installed globally so the entrypoint can call `pm2 start` to
 # boot all three pollers (NBA / WNBA / MLB) alongside the Express API.