feat(backup): incremental restic strategy for R2/S3

Adds a restic-based backup path that streams pg_dump straight into a
restic repository on S3-compatible storage (Cloudflare R2 in
practice — set s3Endpoint to https://<account-id>.r2.cloudflarestorage.com).
Restic's block-level dedup + client-side encryption make daily
incrementals 1-5% of full size and end-to-end encrypted at rest.

Config:
- BackupConfig.strategy: 'snapshot' | 'restic' (default 'snapshot',
  keeps existing behavior back-compat)
- keepDaily/keepWeekly/keepMonthly retention (restic only)

Setup:
- Reads AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY from local env
- Reads RESTIC_PASSWORD from env, or generates one and prints it
- Installs restic via apt on first run
- Writes /etc/shipnode/backup.env (root:root 600) with creds + DB
  connection details, then a script + systemd service+timer

The backup script sources the env file, ensures the repo is
initialized (idempotent), streams DB into restic via --stdin,
snapshots shared/ files, and prunes with configurable retention.

\`backup list\` for restic uses \`restic snapshots --compact\`. \`backup
run\` now goes through systemctl start --wait so the systemd
EnvironmentFile is honored (running the script bare wouldn't work
under a non-root deploy user).

Author: devalade