feat(backups): freshness check + daily alert timer; record rest-server-ana recovery, fstab hardening, esh-pve-nas gap, worldtree admin-key provisioning

scripts/install-backup-freshness-timer.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# install-backup-freshness-timer.sh — install/refresh the daily backup-freshness
+# alert as a systemd USER timer on nh3-dev (the only host with SSH to all backup
+# stores + althing-cli). Idempotent; re-run after editing the wrapper/check.
+# Requires linger (loginctl enable-linger lkraven) so it fires without a login.
+set -euo pipefail
+UNIT_DIR="$HOME/.config/systemd/user"
+REPO=/home/lkraven/development/eshpfi-management
+mkdir -p "$UNIT_DIR"
+
+cat > "$UNIT_DIR/backup-freshness.service" <<EOF
+[Unit]
+Description=Fleet backup freshness check + althing alert
+After=network-online.target
+
+[Service]
+Type=oneshot
+Environment=ALTHING_HANDLE=infra-ops
+ExecStart=$REPO/scripts/backup-freshness-alert.sh
+EOF
+
+cat > "$UNIT_DIR/backup-freshness.timer" <<EOF
+[Unit]
+Description=Daily fleet backup freshness check (08:00)
+
+[Timer]
+OnCalendar=*-*-* 08:00:00
+Persistent=true
+
+[Install]
+WantedBy=timers.target
+EOF
+
+systemctl --user daemon-reload
+systemctl --user enable --now backup-freshness.timer
+echo "installed. next run:"
+systemctl --user list-timers backup-freshness.timer --all --no-pager