feat(backup-system): segundo offsite Backblaze B2 (crown jewels)

- b2-crown-jewels.sh: sync diario 04:00 de las 2 copias mas recientes de
  cada servicio irremplazable (todo menos uptime-kuma) a
  b2:chemavx-k3s-backups/crown-jewels/ (~2GB, tier gratuito).
- reddit-intel.sh sube tambien a B2 (retencion 3d).
- verify.sh comprueba Mega (completo) + B2 (crown jewels).
- Config via Secret out-of-band rclone-conf-b2 (mega+b2, kubectl, NO git);
  consolidar en Infisical RCLONE_CONF cuando se anada [b2] por UI (la
  identity del operator es read-only por API).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backup-system/cronjob-rclone-b2.yaml

@@ -0,0 +1,62 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: rclone-b2-backup
+  namespace: backup-system
+spec:
+  # Segunda copia offsite (crown jewels → Backblaze B2), tras el sync a Mega
+  schedule: "0 4 * * *"
+  concurrencyPolicy: Forbid
+  failedJobsHistoryLimit: 2
+  successfulJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      activeDeadlineSeconds: 3600
+      template:
+        spec:
+          nodeSelector:
+            kubernetes.io/hostname: chemavx-k8
+          restartPolicy: Never
+          securityContext:
+            runAsUser: 0
+          containers:
+            - name: rclone
+              # OJO: imagen BusyBox — el script debe evitar GNU-ismos
+              image: docker.io/rclone/rclone:1.74.3
+              command: ["/bin/sh", "/scripts/b2-crown-jewels.sh"]
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 128Mi
+                limits:
+                  cpu: 500m
+                  memory: 512Mi
+              volumeMounts:
+                - mountPath: /data/backups/backups
+                  name: backup-dir
+                  readOnly: true
+                - mountPath: /rclone
+                  name: rclone-conf
+                - mountPath: /scripts
+                  name: scripts
+          volumes:
+            - name: backup-dir
+              hostPath:
+                path: /data/backups/backups
+                type: Directory
+            # Secret OUT-OF-BAND (kubectl, no en git): remotes mega + b2.
+            # Fuente de verdad deseada: Infisical /backup-system RCLONE_CONF —
+            # cuando se añada el bloque [b2] en la UI, volver a rclone-conf-infisical
+            # y borrar este secret (la identity del operator es read-only, no pudo
+            # escribirse por API el 2026-07-15).
+            - name: rclone-conf
+              secret:
+                secretName: rclone-conf-b2
+                items:
+                  - key: RCLONE_CONF
+                    path: rclone.conf
+            - name: scripts
+              configMap:
+                name: backup-scripts
+                defaultMode: 0755