millenia: nightly encrypted backup, supervision, and hardened Piper units

The canonical instance -- the one with her actual writing -- turned out
to be the least protected thing in the estate:

- No scheduled backup at all; the newest snapshot was a month old. Now
  petal-backup.timer: VACUUM INTO, gzip, age-encrypt with the parodia
  public recipient, push to the VPS over headscale with a size check,
  prune both ends. Persistent=true because the box is not on 24/7.
  Neither machine can decrypt what it holds; the identity is offline.

- Petal ran as a bare ./petal with PPID 1, so a crash or reboot left it
  down until somebody noticed. Now petal.service, verified by kill -9.

- The Piper units retried forever without ever failing: RestartSec=3
  against systemd's default 10s window means the burst limit is never
  reached, which is how a dead service logged 26,800+ restarts over a
  day while read-aloud silently fell back to browser speech.
  StartLimitIntervalSec=300 makes a broken Piper show up in --failed.

backup-petal.sh now handles both deployment shapes (compose exec on the
VPS, local binary on millenia) and encrypts before anything leaves the
host. The VPS no longer uses it -- Petal rides parodia-backup there.

deploy/petal.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=Petal writing editor (millenia)
+# Petal ran unsupervised for a long time -- a bare ./petal with PPID 1, no unit
+# and no screen session -- so a crash or a reboot left it silently down until
+# somebody noticed. It also wants vLLM up first, though it degrades warmly if
+# the model is unreachable, so this is Wants and not Requires.
+After=network-online.target vllm-chat.service
+Wants=network-online.target vllm-chat.service
+
+[Service]
+Type=simple
+User=reala
+WorkingDirectory=/home/reala/petal
+# start.sh carries the environment (ports, LLM endpoint, Piper endpoints and
+# TTS_PATH) and execs the binary, so the service supervises Petal itself rather
+# than a shell wrapper.
+ExecStart=/home/reala/petal/start.sh
+Restart=on-failure
+RestartSec=5
+StandardOutput=append:/home/reala/petal/petal.log
+StandardError=append:/home/reala/petal/petal.log
+
+[Install]
+WantedBy=multi-user.target