v1.21.18 — Automated PostgreSQL backups & tested restore (ADR-109)

Automated PostgreSQL backups with a tested restore (ADR-109). Closes the top operational risk from the 2026-07-07 360° audit: no backup tooling was versioned in the repository and the RPO was undefined. RPO goes from undefined to ≤ 24 h (tunable).

Added

• postgres-backup sidecar (prodrigestivill/postgres-backup-local:16-alpine) in both compose files — ARM64 verified, pg_dump 16.10 matching the pgvector:pg16 server, baked-in healthcheck reflecting the last backup's exit code. Prod: chmod-700 host bind mount prepared by deploy.sh; dev: named volume.
• .env section [80] DATABASE BACKUP in the 3 templates — schedule (@daily), retention 7d/4w/6m, target dir, pg_dump options, TZ; safe compose-level defaults.
• POSTGRES_EXTRA_OPTS pinned to -Z6 --clean --if-exists — full database, self-cleaning single-command restore.
• verify-backup.sh — restores the latest dump into a throwaway pgvector container and compares alembic revision, table count and row counts against the live source.
• Taskfile backup:now / backup:verify, runbook docs/runbooks/DATABASE_BACKUP_RESTORE.md, ADR-109 (alternatives and accepted phase-2 gaps documented).

Changed

• Landing hero refinements (one sentence per line, homogeneous mode badges, 6 locales).
• Showcase surfaces updated in all 6 languages: FAQ changelog + security card + privacy answer, landing data-control card, privacy-by-design blog article, how (new §19.4) / why guides, README, knowledge base.

Tests

• Real backup restored into a throwaway container: 0 SQL errors, alembic_version identical across repo/source/restore, identical row counts on 3 reference tables. docker compose -f docker-compose.prod.yml config clean; sidecar healthy.