feat(backup): per-job schedules, stale-lock recovery, service manifests

- Add per-job `schedule` (systemd OnCalendar) overrides and document the
  global `backup_schedule` / `backup_randomized_delay` knobs.
- Run `restic unlock` before backup/forget/check so a run killed mid-flight
  no longer wedges every later run on a stale exclusive lock.
- Publish backup manifests for fdroid, immich and unifi, so the inventory
  decides only where (repositories, retention, schedule).
- Document that `read_data_subset` re-reads on every job targeting the
  repository, so a large repository wants a small fraction.

roles/fdroid/defaults/main.yml

@@ -11,6 +11,10 @@ fdroid_port: 8070
 # Data directory (keystore, config, metadata, repo APKs)
 fdroid_data_dir: "{{ podman_projects_dir }}/fdroid/data"
 
+# Backup manifest - signing keystore (irreplaceable), config, metadata, published APKs.
+fdroid_backup_paths:
+  - "{{ fdroid_data_dir }}"
+
 # Repository metadata
 fdroid_repo_url: "https://apk.mysite.fr/repo"
 fdroid_repo_name: "F-Droid Repository"