Backups and restore drills

The database is the source of truth; attachments live in MinIO/S3.

Backups: scheduled pg_dump of Postgres plus object-storage sync, per the staging runbook’s backup section.
Restore drills: the runbook’s restore path is exercised as a drill — restore into a scratch database, run the migration harness’s fresh+upgrade checks against it, and spot-check a workspace. A backup that has never been restored is a rumor.
Soft deletes (items, comments) are recoverable at the database level until a purge policy exists; hard purge policy is an open backlog item.