fix: store .obsigate-backup inside vault directory (not parent) for Docker write permissions

- _backup_file: backup_root = vault_path / '.obsigate-backup' (was vault_parent / ...)
- _get_backup_root: same resolution — inside vault, not parent
- Fixes PermissionError on Docker where /vaults/ is read-only

backend/main.py

@@ -723,12 +723,11 @@ def _backup_file(file_path: Path, vault_name: str, relative_path: str):
             logger.debug(f"Backup skipped: file not found {file_path}")
             return
         backup_root = Path(os.environ.get("OBSIGATE_BACKUP_DIR", ".obsigate-backup"))
-        # Resolve relative to vault root for consistency
+        # Resolve relative to vault root (inside vault, so it's always writable)
         if not backup_root.is_absolute():
             vault_data = get_vault_data(vault_name)
             if vault_data:
-                vault_root_path = Path(vault_data["path"])
+                backup_root = Path(vault_data["path"]) / backup_root
-                backup_root = vault_root_path.parent / backup_root
         backup_dir = backup_root / vault_name / Path(relative_path).parent
         backup_dir.mkdir(parents=True, exist_ok=True)
         timestamp = int(time.time())
@@ -1942,16 +1941,15 @@ def _get_backup_root() -> Path:
     """
     root = Path(os.environ.get("OBSIGATE_BACKUP_DIR", ".obsigate-backup"))
     if not root.is_absolute():
-        # Resolve relative to the first vault's parent so backups survive CWD changes
+        # Resolve relative to vault root (inside vault, always writable)
         try:
             from backend.indexer import get_vault_data as _get_vd
-            vaults = index  # use the module-level index
+            vaults = index
             if vaults:
                 first_name = next(iter(vaults.keys()))
                 vd = _get_vd(first_name)
                 if vd:
-                    vault_parent = Path(vd["path"]).parent
+                    root = Path(vd["path"]) / root
-                    root = vault_parent / root
         except Exception:
             pass  # fall back to relative
     return root