feat(backup): per-job schedules, stale-lock recovery, service manifests

- Add per-job `schedule` (systemd OnCalendar) overrides and document the
  global `backup_schedule` / `backup_randomized_delay` knobs.
- Run `restic unlock` before backup/forget/check so a run killed mid-flight
  no longer wedges every later run on a stale exclusive lock.
- Publish backup manifests for fdroid, immich and unifi, so the inventory
  decides only where (repositories, retention, schedule).
- Document that `read_data_subset` re-reads on every job targeting the
  repository, so a large repository wants a small fraction.

roles/backup/README.md

@@ -85,8 +85,8 @@ backup_repositories:
   #   password: "{{ vault_backup_usb_password }}"
   #   retention:
   #     keep_weekly: 12
-  #   notify:
-  #     topic: backups-reminders   # low-priority reminder, not an alarm
+#   notify:
+#     topic: backups-reminders   # low-priority reminder, not an alarm
 
 backup_jobs:
   - name: ntfy
@@ -94,6 +94,7 @@ backup_jobs:
     paths: "{{ ntfy_backup_paths }}"
     exclude: "{{ ntfy_backup_exclude }}"
     sqlite: "{{ ntfy_backup_sqlite }}"
+    schedule: "*-*-* 03:00:00"   # OnCalendar; omit to use the global backup_schedule
 ```
 
 Generate the repository password and **store it outside this repository and outside the machine being backed up**:

roles/backup/defaults/main.yml

@@ -65,7 +65,10 @@ backup_timeout: 4h
 #   read_data_subset  (optional) e.g. "5%" or "1/12". Makes `restic check`
 #                         also re-hash that fraction of the pack files, so the
 #                         whole repository gets verified over time without
-#                         paying for a full read on every run.
+#                         paying for a full read on every run. The check runs on
+#                         every job that targets the repository, so a large
+#                         repository with frequent jobs wants a small fraction
+#                         (1%), or each run pays the read again.
 #   options    (optional) extra restic flags, e.g. ["-o", "s3.list-objects-v1=true"]
 #
 #   notify     (optional) ntfy notification channel for THIS repository. Each

roles/backup/templates/backup.sh.j2

@@ -327,6 +327,15 @@ repo_work() {
         restic init || return 1
     fi
 
+    # A run killed mid-flight (systemd timeout, OOM, reboot) leaves an exclusive
+    # lock behind. `forget --prune` and `check` both need that lock, so every
+    # later run backs up successfully and then fails, until someone clears it by
+    # hand. The per-repository flock above makes us the only local writer, and a
+    # repository is never shared between hosts (see README), so any lock left
+    # here belongs to a dead process. `unlock` only removes locks it considers
+    # stale, so a genuinely live one is left alone.
+    restic unlock || return 1
+
     repo_backup || return 1
     repo_forget || return 1
     repo_check || return 1