Add daily encrypted borgmatic backup service

- /docker/backup: borgmatic container (daily 03:00 Berlin via BACKUP_CRON)
- Backs up /docker (ro) to local encrypted repo /var/backups/borg (repokey-blake2)
- Postgres prod+dev captured via pg_dumpall; live PG data/logs/build artifacts excluded
- Retention: keep_daily 7, keep_weekly 4, keep_monthly 6; runs prune/compact/create/check
- Secrets in backup/.env (gitignored, chmod 600)

.gitignore

@@ -18,3 +18,6 @@
 /dev/redis/data/
 /dev/stripe-stub/.env
 /dev/bandwidth-worker/.env
+
+# Backup service secrets (DB passwords + borg passphrase)
+/backup/.env