TrueNAS config bundle encrypted and synced offsite for total-loss disaster recovery

## Summary
Encrypt the TrueNAS config bundle and place it in a cloud-synced dataset, so a current config backup survives total box loss (fire/theft) without exposing secrets to cloud storage.

## Status
Data-pool **baseline is DONE**: a daily root-only cron tars `/data/freenas-v1.db` + `/data/pwenc_secret` into a non-synced `config-backups` dataset on the pool (covers the single-16GB-boot-flash failure, zero cloud exposure). This issue now covers the **offsite tier** only.

## Motivation
The config bundle contains every secret on the box (admin hash, API keys, Grafana push tokens, cloud_sync OAuth), so it cannot go to Drive/OneDrive in plaintext (the old manual save-to-Drive habit did exactly that). Encrypt-then-sync keeps an offsite DR copy without leaking the secret store. Lower urgency: the actual data already lives in Drive, so a total-loss config rebuild is survivable — this just speeds it up. Related #144.

## Scope
- Choose the encryption mechanism: `openssl enc` (base, no new tooling) vs `age` (fits the chezmoi/age setup) vs an rclone crypt remote.
- Key/passphrase in 1Password, with a root-only on-box copy for the cron.
- Extend the config-backup cron to encrypt the tar and write the ciphertext to a cloud-synced dataset (rides the existing 2-copy offsite).
- Document the decrypt + restore path.

## Acceptance criteria
- [ ] Config bundle lands offsite (Drive/OneDrive) as ciphertext only.
- [ ] Decryption key stored in 1Password; restore path documented.