Validate backup follow-up and harden nearline pull

ops/h-drive-nearline/pull-critical-backups.ps1

@@ -17,13 +17,34 @@ $Jobs = @(
     # nicht ueberbruecken kann. Restore-Quelle dafuer bleibt das
     # Hetzner-Borg-Repo (siehe docs/RESTORE_MATRIX.md Tier 1 Unraid OS Flash).
     ExcludeFiles = @("unraid-flash-config.tar.gz", "unraid-flash-config.tar.gz.sha256", "unraid-flash-config.manifest.txt")
+    Files = @(
+      "borg-ui.sqlite",
+      "filebrowser.bolt.dump",
+      "gitea.sqlite.dump",
+      "grafana.sqlite",
+      "immich.dump",
+      "komodo-mongo.archive.gz",
+      "mealie.dump",
+      "nextcloud.dump",
+      "postgresql17-authelia.dump",
+      "postgresql17-globals.sql",
+      "postgresql17-mailarchiver.dump",
+      "postgresql17-paperless.dump",
+      "speedtest-tracker.sqlite.dump",
+      "vaultwarden.sqlite.dump"
+    )
+    # Migration-/Cutover-Arbeitsverzeichnisse bleiben im Borg-Scope, sind aber
+    # keine Nearline-Pflichtartefakte und enthalten teils root-only Dateien.
+    ExcludeDirs = @(".tmp", "immich-vectorchord-*", "nextcloud-redis-pre-redis8-*", "pg18-major-*", "redis8-*", "shared-redis-pre-redis8-*")
   },
   @{
     Name = "gitea-bundles"
     Source = Join-Path $SourceRoot "git-bundles\gitea"
     Destination = Join-Path $DestinationRoot "git-bundles\gitea"
     Purpose = "Verified bare-repository bundles for Gitea bootstrap"
+    Files = @("*.*")
     ExcludeFiles = @()
+    ExcludeDirs = @(".tmp")
   }
 )
 
@@ -47,9 +68,17 @@ function Invoke-RobocopyJob {
   $logPath = Join-Path $LogRoot ("{0}-{1}.log" -f (Get-Date -Format "yyyyMMdd-HHmmss"), $Job.Name)
   New-Item -ItemType Directory -Force -Path $Job.Destination | Out-Null
 
+  $files = @("*.*")
+  if ($Job.ContainsKey("Files") -and $Job.Files.Count -gt 0) {
+    $files = $Job.Files
+  }
+
   $args = @(
     $Job.Source,
-    $Job.Destination,
+    $Job.Destination
+  )
+  $args += $files
+  $args += @(
     "/E",
     "/COPY:DAT",
     "/DCOPY:DAT",
@@ -57,13 +86,16 @@ function Invoke-RobocopyJob {
     "/W:5",
     "/FFT",
     "/XJ",
-    "/XD",
-    ".tmp",
     "/NP",
     "/TEE",
     "/LOG:$logPath"
   )
 
+  if ($Job.ContainsKey("ExcludeDirs") -and $Job.ExcludeDirs.Count -gt 0) {
+    $args += "/XD"
+    $args += $Job.ExcludeDirs
+  }
+
   if ($Job.ContainsKey("ExcludeFiles") -and $Job.ExcludeFiles.Count -gt 0) {
     $args += "/XF"
     $args += $Job.ExcludeFiles