feat(backup): per-job schedules, stale-lock recovery, service manifests

- Add per-job `schedule` (systemd OnCalendar) overrides and document the
  global `backup_schedule` / `backup_randomized_delay` knobs.
- Run `restic unlock` before backup/forget/check so a run killed mid-flight
  no longer wedges every later run on a stale exclusive lock.
- Publish backup manifests for fdroid, immich and unifi, so the inventory
  decides only where (repositories, retention, schedule).
- Document that `read_data_subset` re-reads on every job targeting the
  repository, so a large repository wants a small fraction.

roles/unifi/defaults/main.yml

@@ -8,6 +8,10 @@ unifi_image: docker.io/jacobalberty/unifi
 # Storage location for persistent data (MongoDB, config, backups)
 unifi_data_dir: "{{ podman_projects_dir }}/unifi/data"
 
+# Backup manifest - MongoDB (device/AP config), settings and auto-backups.
+unifi_backup_paths:
+  - "{{ unifi_data_dir }}"
+
 # Network binding — REQUIRED, must be set in inventory
 # IP address of the LAN interface for AP communication (inform, STUN, discovery).
 # APs must be able to reach this address.