feat(deploy): continuous WAL archiving to S3 for point-in-time recovery

Add pgBackRest-based PITR for the production database, shipped disarmed
(archive_mode and the base-backup timer gated off) so it stays inert until the
operator arms it before real payments — an un-armed deploy cannot pile WAL onto
the disk.

- Postgres now builds from a thin image carrying pgBackRest (archive_command runs
  in-process); the prod overlay wires an encrypted (AES-256-CBC), path-style S3
  repository with 30-day retention and a daily full base-backup systemd timer.
- Repository config/secrets flow through the PROD_PGBACKREST_* Gitea set and
  write-prod-env.sh; prod-rollback re-renders the same env so a rollback cannot
  disarm archiving.
- Grafana alerts watch pg_stat_archiver (failing / stalled), absent-safe on the
  test contour, which never archives.
- Fix the pre-migration pg_dump to snapshot the whole database (was backend-only,
  silently excluding payments).
- Document the PITR runbook, the arming sequence and the restore drill in
  deploy/README.md; record the measured cost/perf assessment.

deploy/write-prod-env.sh

@@ -73,4 +73,15 @@ export GF_SMTP_ENABLED='$GF_SMTP_ENABLED'
 export PUBLIC_BASE_URL='$PUBLIC_BASE_URL'
 export GATEWAY_HONEYTOKEN='$GATEWAY_HONEYTOKEN'
 export GATEWAY_ABUSE_BAN_ENABLED='true'
+# Continuous WAL archiving (pgBackRest -> S3) for point-in-time recovery. The artifact
+# ships disarmed: PGBACKREST_ARCHIVE_MODE defaults off, so archiving stays inert until the
+# operator sets the S3 repository values + secrets, creates the stanza and flips the switch
+# on (deploy/README.md). Empty repository values are harmless while the mode is off.
+export PGBACKREST_ARCHIVE_MODE='${PGBACKREST_ARCHIVE_MODE:-off}'
+export PGBACKREST_S3_ENDPOINT='$PGBACKREST_S3_ENDPOINT'
+export PGBACKREST_S3_BUCKET='$PGBACKREST_S3_BUCKET'
+export PGBACKREST_S3_REGION='$PGBACKREST_S3_REGION'
+export PGBACKREST_S3_KEY='$PGBACKREST_S3_KEY'
+export PGBACKREST_S3_KEY_SECRET='$PGBACKREST_S3_KEY_SECRET'
+export PGBACKREST_CIPHER_PASS='$PGBACKREST_CIPHER_PASS'
 EOF