Add daily encrypted borgmatic backup service

- /docker/backup: borgmatic container (daily 03:00 Berlin via BACKUP_CRON)
- Backs up /docker (ro) to local encrypted repo /var/backups/borg (repokey-blake2)
- Postgres prod+dev captured via pg_dumpall; live PG data/logs/build artifacts excluded
- Retention: keep_daily 7, keep_weekly 4, keep_monthly 6; runs prune/compact/create/check
- Secrets in backup/.env (gitignored, chmod 600)

backup/docker-compose.yml

@@ -0,0 +1,40 @@
+name: backup
+services:
+  borgmatic:
+    image: ghcr.io/borgmatic-collective/borgmatic:latest
+    container_name: borgmatic
+    hostname: linumiq-borgmatic
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    environment:
+      TZ: Europe/Berlin
+      # Daily backup at 03:00 server-local time. The image writes this to
+      # /etc/crontabs/root and runs: borgmatic --stats -v 0
+      BACKUP_CRON: "0 3 * * *"
+    env_file:
+      - ./.env
+    volumes:
+      # Backup source (read-only — borgmatic never writes to /docker).
+      - /docker:/docker:ro
+      # Local borg repository (host-side, same disk; remote planned later).
+      - /var/backups/borg:/repository
+      # borgmatic configuration.
+      - ./borgmatic.d:/etc/borgmatic.d:ro
+      # Persist borg cache + security dir across container recreation so borg
+      # does not re-scan the whole repo or warn about an "unknown" repository.
+      - borg_cache:/root/.cache/borg
+      - borg_security:/root/.config/borg
+    networks:
+      # Reach the prod + dev Postgres containers (supabase-db / supabase-dev-db)
+      # by container name for the pg_dumpall hook.
+      - supabase_default
+      - supabase-dev_default
+volumes:
+  borg_cache:
+  borg_security:
+networks:
+  supabase_default:
+    external: true
+  supabase-dev_default:
+    external: true