Separate one-shot utility

Dockerfile

@@ -53,3 +53,11 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
     CMD ["node", "-e", "fetch('http://127.0.0.1:3001/healthz', {signal: AbortSignal.timeout(4000)}).then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
 # Node 24 strips the server's erasable TypeScript; no tsx/dev dependencies at runtime.
 CMD ["node", "--experimental-strip-types", "server/index.ts"]
+
+# Explicit one-shot maintenance image, derived from runtime so it has no development dependencies.
+FROM runtime AS custody-backup
+USER root
+RUN apk add --no-cache postgresql-client
+COPY scripts/custody-pair-backup.ts ./scripts/custody-pair-backup.ts
+USER node
+ENTRYPOINT ["node", "--experimental-strip-types", "scripts/custody-pair-backup.ts"]