feat(backup-system): cobertura completa del homelab + sync diario a Mega

- backup.sh: fix openclaw (tar-eaba un hostPath stub vacio, 104 bytes/dia
  desde hace meses); ahora resuelve el PVC real via local-path.
- Nuevos servicios: ghost-en/zona-exclusion (VACUUM INTO consistente via
  node del pod + tar del content), gitea (sqlite .backup + repos + conf,
  sin packages 6.4G reconstruibles), researchowl (sqlite backup API via
  python3), roswell-pg, umami-pg, infisical-pg, trilium, vaultwarden,
  uptime-kuma (sqlite3 .backup), filebrowser-db, home-master (sin ~/.ssh
  ni caches), k3s token + /etc/rancher/k3s (cadena de restauracion).
- Validacion por artefacto: gzip -t + tamano minimo; el job sale 1 si
  falta algo -> alerta Grafana->Telegram existente.
- rclone-mega: de semanal a diario (03:30); --exclude reddit-intel/.
- Nuevo CronJob reddit-intel-backup en n97 (unico dato del worker fuera
  de k3s; su cron local escribia en el mismo disco).
- verify.sh: lista completa (20 servicios + reddit-intel), diario,
  ventana de frescura 3 dias (BusyBox-safe).
- backoffLimit 1 (retry recrearia artefactos y romperia la retencion).
- RESTORE.md: runbook con la cadena token->state.db->infisical-secrets.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backup-system/cronjob-reddit-intel.yaml

@@ -0,0 +1,58 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: reddit-intel-backup
+  namespace: backup-system
+spec:
+  # Único CronJob de backup que corre en n97: /opt/reddit-intel vive fuera de k3s
+  # (Docker en el host) y su cron local escribe en el mismo disco.
+  schedule: "15 3 * * *"
+  concurrencyPolicy: Forbid
+  failedJobsHistoryLimit: 2
+  successfulJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      activeDeadlineSeconds: 1800
+      template:
+        spec:
+          nodeSelector:
+            kubernetes.io/hostname: chemavx-n97
+          restartPolicy: Never
+          securityContext:
+            runAsUser: 0
+          containers:
+            - name: rclone
+              # OJO: imagen BusyBox — el script debe evitar GNU-ismos
+              image: docker.io/rclone/rclone:1.74.3
+              command: ["/bin/sh", "/scripts/reddit-intel.sh"]
+              resources:
+                requests:
+                  cpu: 50m
+                  memory: 64Mi
+                limits:
+                  cpu: 200m
+                  memory: 256Mi
+              volumeMounts:
+                - mountPath: /opt/reddit-intel
+                  name: reddit-intel
+                  readOnly: true
+                - mountPath: /rclone
+                  name: rclone-conf
+                - mountPath: /scripts
+                  name: scripts
+          volumes:
+            - name: reddit-intel
+              hostPath:
+                path: /opt/reddit-intel
+                type: Directory
+            - name: rclone-conf
+              secret:
+                secretName: rclone-conf-infisical
+                items:
+                  - key: RCLONE_CONF
+                    path: rclone.conf
+            - name: scripts
+              configMap:
+                name: backup-scripts
+                defaultMode: 0755