fix(deploy): run the base-backup timer's pgBackRest as the postgres role

docker exec defaults to root, so the systemd base-backup timer connected to the
database as role "root" (then "postgres") — neither exists; the superuser role is
POSTGRES_USER (scrabble). Run the timer's pgBackRest as the postgres OS user (-u postgres,
for lock-dir/PGDATA consistency with archive-push) and connect with --pg1-user=scrabble.
archive_command (run by the postgres server process) was already correct.

Also record the point-in-time-recovery arming + restore drill in deploy/README.md
(correct the runbook commands to the same invocation, fill the drill log) and mark the
durability work done in PLAN.md.

deploy/ansible/roles/main/templates/pgbackrest-backup.service.j2

@@ -10,6 +10,8 @@ Requires=docker.service
 
 [Service]
 Type=oneshot
-# docker exec runs as the image's postgres user and inherits the container's PGBACKREST_*
-# environment (the S3 repository + cipher), so no repository config is needed on the host.
-ExecStart=/usr/bin/docker exec scrabble-postgres pgbackrest --stanza=scrabble --type=full backup
+# docker exec defaults to root, so run as the postgres OS user (-u postgres) for lock-dir and
+# PGDATA consistency with archive-push, and connect to the database as the superuser role via
+# --pg1-user: that role is the POSTGRES_USER (scrabble), not "postgres". It inherits the
+# container's PGBACKREST_* environment (the S3 repository + cipher), so no host-side config.
+ExecStart=/usr/bin/docker exec -u postgres scrabble-postgres pgbackrest --stanza=scrabble --pg1-user=scrabble --type=full backup