Back up the bus by the server's own snapshot of each stream, not its live files (hq ADR 0235)

The restic holder copied JetStream's store while the server wrote it; such a
copy may not restore. The nats image now carries mesh-nats-snapshot, run by
the declared dump under the module's own bus account (snapshot API only):
every stream one at a time, flow-controlled, into one tar with a manifest of
counts, sequences and checksums. Restore builds a new store beside the live
one with the bus's own server; a person swaps it in. Proven against
throwaway nats 2.11 servers being written to during the snapshot.

modules/nats/module.json

@@ -14,6 +14,9 @@
     }
   ],
   "bus-users": "/var/lib/nats-module/conf/accounts.conf",
+  "own-secrets": {
+    "broker": "${dir:mesh-state}/broker"
+  },
   "capabilities": [
     "container-runtime"
   ],
@@ -48,7 +51,17 @@
         "path": "${dir:jetstream-data}",
         "class": "valuable",
         "active": "1d",
-        "why": "the bus's streams and key-value buckets: the hand-act log, conditions, every module's state; written all the time"
+        "backup": {
+          "dump": "docker exec -i mesh-broker-nats mesh-nats-snapshot snapshot < ${dir:mesh-state}/broker > ${dir:snapshots}/bus.tar.partial && mv ${dir:snapshots}/bus.tar.partial ${dir:snapshots}/bus.tar || { rm -f ${dir:snapshots}/bus.tar.partial; exit 1; }",
+          "into": "snapshots"
+        },
+        "why": "the bus's streams and key-value buckets: the hand-act log, conditions, every module's state; written all the time, so copied by the server's own snapshot of each stream (novox/hq ADR 0235), never as live files"
+      },
+      {
+        "id": "snapshots",
+        "path": "${dir:snapshots}",
+        "class": "rebuildable",
+        "why": "last night's snapshot of every stream with its manifest, made again every night"
       }
     ]
   },
@@ -65,6 +78,17 @@
       "path": "/var/lib/nats-module/conf",
       "mode": "0700"
     },
+    {
+      "id": "snapshots",
+      "type": "directory",
+      "mode": "0700"
+    },
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh"
+    },
     {
       "id": "server-conf",
       "type": "file",
@@ -100,6 +124,10 @@
       {
         "arg": "NATS_BASE",
         "image": "nats@sha256:e4bf19f15fd3218814a4e3c9e0064e1334bd8aa20d5984b9f1a0afd084f8cc00"
+      },
+      {
+        "arg": "GO_BASE",
+        "image": "golang@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c"
       }
     ],
     "artifacts": [