feat(backup-system): cobertura completa del homelab + sync diario a Mega

- backup.sh: fix openclaw (tar-eaba un hostPath stub vacio, 104 bytes/dia
  desde hace meses); ahora resuelve el PVC real via local-path.
- Nuevos servicios: ghost-en/zona-exclusion (VACUUM INTO consistente via
  node del pod + tar del content), gitea (sqlite .backup + repos + conf,
  sin packages 6.4G reconstruibles), researchowl (sqlite backup API via
  python3), roswell-pg, umami-pg, infisical-pg, trilium, vaultwarden,
  uptime-kuma (sqlite3 .backup), filebrowser-db, home-master (sin ~/.ssh
  ni caches), k3s token + /etc/rancher/k3s (cadena de restauracion).
- Validacion por artefacto: gzip -t + tamano minimo; el job sale 1 si
  falta algo -> alerta Grafana->Telegram existente.
- rclone-mega: de semanal a diario (03:30); --exclude reddit-intel/.
- Nuevo CronJob reddit-intel-backup en n97 (unico dato del worker fuera
  de k3s; su cron local escribia en el mismo disco).
- verify.sh: lista completa (20 servicios + reddit-intel), diario,
  ventana de frescura 3 dias (BusyBox-safe).
- backoffLimit 1 (retry recrearia artefactos y romperia la retencion).
- RESTORE.md: runbook con la cadena token->state.db->infisical-secrets.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backup-system/cronjob-backup.yaml

@@ -10,9 +10,13 @@ spec:
   failedJobsHistoryLimit: 1
   jobTemplate:
     spec:
+      # Sin reintentos automáticos: un reintento re-crea TODOS los artefactos con
+      # otro timestamp y la retención por número podría expulsar copias buenas.
+      backoffLimit: 1
+      activeDeadlineSeconds: 3600
       template:
         spec:
-          restartPolicy: OnFailure
+          restartPolicy: Never
           serviceAccountName: backup-sa
           securityContext:
             runAsUser: 0
@@ -29,11 +33,11 @@ spec:
               value: /kubeconfig/k3s.yaml
             resources:
               requests:
-                cpu: 100m
-                memory: 128Mi
+                cpu: 200m
+                memory: 256Mi
               limits:
-                cpu: 500m
-                memory: 512Mi
+                cpu: "1"
+                memory: 1Gi
             volumeMounts:
             - name: backup-dir
               mountPath: /data/backups/backups
@@ -50,6 +54,15 @@ spec:
             - name: k3s-db
               mountPath: /data/k3s-db
               readOnly: true
+            - name: k3s-token
+              mountPath: /host/k3s-token
+              readOnly: true
+            - name: etc-rancher-k3s
+              mountPath: /host/etc-rancher-k3s
+              readOnly: true
+            - name: home-chemavx
+              mountPath: /host/home-chemavx
+              readOnly: true
           volumes:
           - name: backup-dir
             hostPath:
@@ -79,3 +92,15 @@ spec:
             hostPath:
               path: /var/lib/rancher/k3s/server/db
               type: Directory
+          - name: k3s-token
+            hostPath:
+              path: /var/lib/rancher/k3s/server/token
+              type: File
+          - name: etc-rancher-k3s
+            hostPath:
+              path: /etc/rancher/k3s
+              type: Directory
+          - name: home-chemavx
+            hostPath:
+              path: /home/chemavx
+              type: Directory