Backups: the nightly dump stays on the host it protects; add an optional S3 copy

The nightly backup never leaves the machine it exists to protect.

## Where

`scripts/backup-cron.sh` (and its copy `quickstart/scripts/backup-cron.sh`) dumps to `/backups`, checks the dump, gzips it, and deletes files older than `BACKUP_KEEP_DAYS`. `/backups` is a Docker volume on the same host as Postgres. Losing the host, its disk, or the volume takes the database and every retained backup together.

BaryoDev/BaryoVM#39 is the same gap for stacks deployed by BaryoVM. This issue is the one for the compose files this repository ships.

## Proposal

After a dump passes its checks, optionally copy it to S3-compatible storage:

- Off unless `BACKUP_S3_BUCKET` is set, so existing deployments behave exactly as today.
- Same credentials shape as Files.S3 (bucket, region, access key, secret key, optional endpoint for R2 or a self-hosted store), but a separate bucket or prefix, and ideally a separate key with write-only permission (`s3:PutObject` only), so a compromised app host cannot delete the off-box copies.
- Retention off-box is left to the bucket's lifecycle rules, not the script, for the same reason.
- A failed upload fails the run loudly, the same way a bad dump does, without deleting the local copy.

## Done when

- With the variable unset, the script output and behaviour are unchanged (the drift check against the quickstart copy still passes).
- With it set, a CI job uploads a dump to a test S3 server (SeaweedFS, as the Files.S3 tests use) and restores from the uploaded copy.
- `docs/backup-and-restore.md` documents the write-only policy and a lifecycle rule example.

Start with scripts/backup-cron.sh and quickstart/scripts/backup-cron.sh, then review the Files.S3 tests for the existing credentials shape and SeaweedFS setup. Add the optional upload path without changing unset-variable behavior, and update docs/backup-and-restore.md. Done means the drift check passes, CI uploads and restores a dump from the test S3 server, and failed uploads leave the local copy intact.

Written by the indexing model from the issue text.