feat(backup): add restic backup role with encrypted incremental snapshots

Restic-backed backups using a many-to-many repository/job model.

- repository = destination: restic repository URL verbatim (s3, local,
  removable device), backend credentials via env passthrough, retention
  policy, and an optional per-repository ntfy notify channel
- job = source set: paths, sqlite and postgres dumps (consistent .backup /
  pg_dump instead of torn live-file copies), pushed to one or more repos
- systemd timer per job, per-repo + per-job flock serialisation, restic
  check with read_data_subset for rotating integrity verification

Service roles declare what to back up (ntfy_backup_*, uptime_kuma_backup_*);
the inventory declares where.

roles/backup/vars/archlinux.yml

@@ -0,0 +1,15 @@
+---
+backup_packages:
+  - restic
+  - util-linux # mountpoint, runuser, flock
+  - curl
+
+# Only installed when a job declares a `sqlite` source.
+backup_sqlite_packages:
+  - sqlite
+
+# Only installed when a job declares a `postgres` source. On a host that also
+# runs the postgres role this is already present; the package is listed so the
+# role works on a host that only dumps a remote database.
+backup_postgres_packages:
+  - postgresql