feat(backup): wire Velero + CNPG Barman to the live MinIO S3 target

Author the GitOps side of off-cluster backups against the on-Proxmox MinIO
(http://192.168.1.9:9000, path-style; buckets velero + cnpg).

Velero (R-STATE-03):
- HelmRelease (chart 8.x / Velero 1.15) + velero-plugin-for-aws init container +
  node-agent kopia File System Backup (deployNodeAgent, uploaderType=kopia,
  snapshotsEnabled=false). BSL default -> bucket velero, s3ForcePathStyle.
- Two daily Schedules: `daily` backs up the whole cluster's resources+PVC data
  (defaultVolumesToFsBackup opt-out) EXCEPT monitoring+unifi; `daily-resources-only`
  captures monitoring+unifi RESOURCES only (Prometheus TSDB, Loki 72h logs, and the
  ~7.4GiB UniFi VM disk are reconstructable — excluded from volume backup).
- velero-cloud-credentials SOPS Secret (cloud INI key, ns velero).
- Own non-gating Flux tier clusters/base/backup.yaml (dependsOn platform-config,
  wait:false) + clusters/dev SOPS decryption patch — mirrors headlamp.

CNPG native Barman PITR (R-IDP-05 / R-STATE-03):
- keycloak-db, nextcloud-db, semaphore-db gain spec.backup.barmanObjectStore
  (s3://cnpg/<cluster>, endpointURL MinIO, gzip WAL+data, 30d retention) + a daily
  ScheduledBackup (6-field cron, immediate) each.
- Per-namespace scoped-key SOPS Secrets (<db>-backup-credentials), same-ns only.
- render.py: emit-waves now recognizes <svc>-db-backup-credentials.sops.yaml as a
  DB-wave sidecar (+ self-test); wave-0 kustomization regenerated.

Creds mirror platform/backup/minio-credentials.sops.yaml (scoped key k3s-backup),
SOPS round-trip verified with the cluster age key. gate: green.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/velero/values.yaml

@@ -1,7 +1,12 @@
-# Velero Helm values — PLACEHOLDER (Phase 0). Authoritative values inline in helmrelease.yaml.
+# Velero Helm values — the AUTHORITATIVE values live inline in helmrelease.yaml (this file is a
+# doc pointer, kept for parity with the other components' layout).
 #
-# backupStorageLocation: off-cluster S3-compatible/NFS (ADR-0003; concrete target = OQ-2)
-# volumeSnapshotLocation: Longhorn CSI snapshots / Velero fs-backup
-# credentials.existingSecret: velero-backup-credentials  (SOPS-encrypted, WS-SEC — name only)
-# schedules.daily: ${VELERO_BACKUP_SCHEDULE} / ttl ${VELERO_RETENTION}   (overlay knobs)
-# DR drill (tested restore) is a Phase-4 acceptance gate (R-STATE-03).
+# LIVE wiring (see helmrelease.yaml):
+#   - provider aws + velero-plugin-for-aws (init container) → MinIO S3 http://192.168.1.9:9000
+#     (path-style, bucket `velero`, region us-east-1 placeholder).
+#   - deployNodeAgent:true + uploaderType:kopia → File System Backup of PVC data (no CSI data-mover).
+#   - snapshotsEnabled:false → no VolumeSnapshotLocation.
+#   - credentials.existingSecret: velero-cloud-credentials (SOPS `cloud` INI key, ns velero).
+#   - two daily Schedules (${VELERO_BACKUP_SCHEDULE} / ttl ${VELERO_RETENTION}): the whole cluster
+#     via FSB, with monitoring+unifi backed up RESOURCES-ONLY (their volume data is reconstructable).
+# DR drill (tested restore) remains a Phase-4 acceptance gate (R-STATE-03) — the PM runs it post-deploy.