feat(backup): add restic backup role with encrypted incremental snapshots

Restic-backed backups using a many-to-many repository/job model.

- repository = destination: restic repository URL verbatim (s3, local,
  removable device), backend credentials via env passthrough, retention
  policy, and an optional per-repository ntfy notify channel
- job = source set: paths, sqlite and postgres dumps (consistent .backup /
  pg_dump instead of torn live-file copies), pushed to one or more repos
- systemd timer per job, per-repo + per-job flock serialisation, restic
  check with read_data_subset for rotating integrity verification

Service roles declare what to back up (ntfy_backup_*, uptime_kuma_backup_*);
the inventory declares where.

roles/backup/templates/job.conf.j2

@@ -0,0 +1,45 @@
+# Managed by Ansible (roles/backup). Do not edit on the host.
+# Job definition sourced by {{ backup_script_path }}.
+
+JOB_REPOSITORIES=(
+{% for name in job.repositories %}
+    {{ name | quote }}
+{% endfor %}
+)
+
+JOB_PATHS=(
+{% for path in job.paths | default([]) %}
+    {{ path | quote }}
+{% endfor %}
+)
+
+JOB_EXCLUDES=(
+{% for pattern in job.exclude | default([]) %}
+    {{ pattern | quote }}
+{% endfor %}
+)
+
+JOB_SQLITE=(
+{% for path in job.sqlite | default([]) %}
+    {{ path | quote }}
+{% endfor %}
+)
+
+JOB_POSTGRES=(
+{% if job.postgres is defined %}
+{% if job.postgres is string %}
+    {{ job.postgres | quote }}
+{% else %}
+{% for database in job.postgres %}
+    {{ database | quote }}
+{% endfor %}
+{% endif %}
+{% endif %}
+)
+
+{% if job.command is defined and job.command | length > 0 %}
+# Runs after the declarative dumps, with $DUMPS pointing at the staging dir.
+JOB_COMMAND={{ job.command | trim | quote }}
+{% else %}
+JOB_COMMAND=""
+{% endif %}