millenia: nightly encrypted backup, supervision, and hardened Piper units

The canonical instance -- the one with her actual writing -- turned out
to be the least protected thing in the estate:

- No scheduled backup at all; the newest snapshot was a month old. Now
  petal-backup.timer: VACUUM INTO, gzip, age-encrypt with the parodia
  public recipient, push to the VPS over headscale with a size check,
  prune both ends. Persistent=true because the box is not on 24/7.
  Neither machine can decrypt what it holds; the identity is offline.

- Petal ran as a bare ./petal with PPID 1, so a crash or reboot left it
  down until somebody noticed. Now petal.service, verified by kill -9.

- The Piper units retried forever without ever failing: RestartSec=3
  against systemd's default 10s window means the burst limit is never
  reached, which is how a dead service logged 26,800+ restarts over a
  day while read-aloud silently fell back to browser speech.
  StartLimitIntervalSec=300 makes a broken Piper show up in --failed.

backup-petal.sh now handles both deployment shapes (compose exec on the
VPS, local binary on millenia) and encrypts before anything leaves the
host. The VPS no longer uses it -- Petal rides parodia-backup there.

deploy/petal-backup.service

@@ -0,0 +1,23 @@
+[Unit]
+Description=Nightly backup of Petal's database (millenia)
+Documentation=file:///home/reala/petal/deploy/README.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=reala
+WorkingDirectory=/home/reala/petal
+# Encrypted with the parodia age recipient before it leaves the box, then
+# pushed to the VPS over headscale. The recipient is a public key and the
+# private identity is offline, so neither millenia nor the VPS can decrypt what
+# they are holding. Replaces nothing -- before this there was no scheduled
+# backup of her writing at all; the newest snapshot on 2026-07-27 was a month
+# old.
+Environment=AGE_RECIPIENT=age19n4k55m9d50xew5vj2ehmcsf3wuj7fhgmfpckadpvcya4032q9dqrt4yjw
+Environment=REMOTE_USER=reala
+Environment=REMOTE_HOST=100.64.0.1
+Environment=REMOTE_DIR=petal-backups-millenia
+ExecStart=/home/reala/petal/deploy/backup-petal.sh
+Nice=10
+IOSchedulingClass=idle