feat(backup-system): segundo offsite Backblaze B2 (crown jewels)

- b2-crown-jewels.sh: sync diario 04:00 de las 2 copias mas recientes de
  cada servicio irremplazable (todo menos uptime-kuma) a
  b2:chemavx-k3s-backups/crown-jewels/ (~2GB, tier gratuito).
- reddit-intel.sh sube tambien a B2 (retencion 3d).
- verify.sh comprueba Mega (completo) + B2 (crown jewels).
- Config via Secret out-of-band rclone-conf-b2 (mega+b2, kubectl, NO git);
  consolidar en Infisical RCLONE_CONF cuando se anada [b2] por UI (la
  identity del operator es read-only por API).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backup-system/cronjob-backup-verify.yaml

@@ -36,9 +36,10 @@ spec:
                 - mountPath: /scripts
                   name: scripts
           volumes:
+            # rclone-conf-b2: secret out-of-band con mega+b2 (verify comprueba ambos)
             - name: rclone-conf
               secret:
-                secretName: rclone-conf-infisical
+                secretName: rclone-conf-b2
                 items:
                   - key: RCLONE_CONF
                     path: rclone.conf