selfhost: the backup is written in the clear and relies on a manual next step

[L4XB]

Problem

deploy/community/backup.sh writes database.dump, app-data.tar.gz,
privacy-data.tar.gz, METADATA and SHA256SUMS into a directory with mode
700. Nothing is encrypted.

The documentation is honest about it — BACKUP-RESTORE.md:37 says
"Immediately copy the completed directory to separately encrypted storage" —
so this is a stated design decision, not a hidden gap.

The problem is what that decision leans on. The archive contains participant
interview content, uploaded documents and the privacy dataset, and it sits
unencrypted on the host until a human performs a separate step that nothing
checks, reminds, or verifies. "Immediately" is doing a lot of work in a
procedure that runs on a schedule.

There is also a concrete inconsistency: #29 lists as an acceptance criterion
"Produce an encrypted backup with a manifest and checksums, then verify it
before restore." That is not what the script does today.

What to decide

1. Should backup.sh encrypt at creation — a --recovery-password or a
   recipient key — so the artifact is never in the clear on disk?
2. If not, test(self-host): prove install, upgrade, backup, restore, and erasure replay #29's criterion needs rewording, and the operator responsibility
   needs to be somewhere harder to miss than one line of a runbook.

Either answer is defensible. What is not defensible is the current state, where
one document assumes a property another document says the operator must supply.

If encryption is added

• restore.sh has to stay usable without the key for the parts that do not need
  it, or fail with a message naming what is missing
• A wrong password must fail closed and say so, not produce a corrupt restore —
  test(self-host): prove install, upgrade, backup, restore, and erasure replay #29 lists exactly this case
• The key must never reach the shell history, the environment file, or the
  backup directory

Acceptance criteria

• A decision, recorded here
• #29 and BACKUP-RESTORE.md agree with the implementation afterwards
• If encrypted: wrong-password and corrupt-archive paths are tested