stats: fix role-name quoting in the stats migration grants; add deploy/stats-collector (systemd user timers for CBS, Eurostat, FRED, BIS)

deploy/stats-collector/stats-collector-run.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# /stats collector runner (systemd: stats-collector@<source>.service, one timer per source).
+#   stats-collector-run.sh <source> [--backfill|--force|--only=…]
+# Runs scripts/stats-fetch.ts from a detached checkout of origin/main (~/dev/stats-runner), with
+# DB_URL read fresh from the app container each run (never stored on disk). One lock per source,
+# so a slow backfill and its timer never overlap; a shared lock guards the checkout update.
+set -euo pipefail
+source_name=${1:?source required (cbs, eurostat, fred, bis, …)}
+case "$source_name" in *[!a-z0-9-]*) echo "bad source name" >&2; exit 2 ;; esac
+runner="${STATS_RUNNER_DIR:-$HOME/dev/stats-runner}"
+locks="${XDG_RUNTIME_DIR:-/tmp}/stats-collector"
+mkdir -p "$locks"
+exec 9>"$locks/$source_name.lock"
+if ! flock -w "${STATS_LOCK_WAIT:-3600}" 9; then
+	echo "another $source_name run still holds the lock; giving up" >&2
+	exit 75
+fi
+if [ ! -e "$runner/.git" ]; then
+	git -C "$HOME/dev/personal-website" fetch -q origin
+	git -C "$HOME/dev/personal-website" worktree add -q --detach "$runner" origin/main
+fi
+(
+	flock -w 600 8
+	cd "$runner"
+	git fetch -q origin
+	git checkout -q --detach origin/main
+	bun install --frozen-lockfile --silent
+) 8>"$locks/checkout.lock"
+cd "$runner"
+DB_URL=$(sudo -n docker inspect personal-website-app-1 --format '{{range .Config.Env}}{{println .}}{{end}}' \
+	| sed -n 's/^DB_URL=//p' | sed 's/@db:5432/@127.0.0.1:5440/')
+[ -n "$DB_URL" ] || { echo "no DB_URL from app container" >&2; exit 1; }
+export DB_URL
+exec nice -n 10 bun scripts/stats-fetch.ts "$@"