restic/ana-docker: extend pre-backup hooks (vaultwarden/gitea/openwebui)

Audit surfaced three DB-backed services not being dumped consistently
by the existing pre-backup.sh:

  - vaultwarden — migrated to external Postgres on PFI-Postgres
    (10.250.50.80); old sqlite block was dumping stale pre-migration
    files. Replace with pg_dump against the live database. Requires
    postgresql-client on ana-docker and VW_PG* creds in
    /etc/restic/dbcreds.env.
  - gitea — also on PFI-Postgres; no hook existed at all. Use
    `gitea dump` for a single zip that captures DB + repos + config +
    LFS + attachments consistently. No explicit creds needed; the
    container reads its own GITEA__database__* env.
  - openwebui — two local SQLite databases (webui.db + the ChromaDB
    vector store). .backup command if sqlite3 is in the image, volume-
    level fallback otherwise.

Refactor: each block now logs a WARN on failure instead of aborting the
whole script — partial dumps > no dumps when one service has an issue.

dbcreds.env.example committed as a template; real file goes to
/etc/restic/dbcreds.env root:600 on the host and is never in the repo.

Mattermost retired (user confirmed 2026-04-21); removed from the
pre-backup.sh list and flagged in README's stacks section. Mattermost
container was not running regardless; the audit surfaced that it was
already effectively gone. Compose dir on ana-docker can be removed as
separate cleanup.

README.md

@@ -67,6 +67,7 @@ Per-host snapshots of the running system live under `servers/<host>/system-detai
 
 **Anaheim non-GPU (ana-docker):**
 - `traefik`, `crowdsec`, `gitea`, `vaultwarden`, `synapse`, `seafile`, `searxng`, `openwebui`, `sillytavern`, `mailrise`, `rustdesk`, `dockge`, `it-tools`
+- (`mattermost` retired 2026-04-21 — compose dir may still linger, containers gone)
 - Fleet services: `beszel` (metrics hub, port 8090), `dozzle-hub` (log viewer, 8088), `backrest` (restic UI, 9898)
 - Backup target: `rest-server-ana` on port 8000