Provision Jotwink databases and encrypted backups

[kaanyagci]

What changed

• adds idempotent bootstrap SQL for the jotwink and keycloak_jotwink databases and roles
• adds explicit TLS-only HBA rules for the application and identity paths
• adds a six-hour backup service covering both databases
• encrypts each retained dump with OpenSSL CMS AES-256-GCM before it reaches persistent backup storage
• adds checksums, health markers, retention, operator preflight, and a fail-closed non-production restore verifier
• updates production Compose and deployment validation for the new service and certificate configuration

Why

Jotwink needs product and identity databases that remain isolated from each other and from existing applications. The paid release also requires encrypted, regularly tested backups for both stores.

Impact

This PR does not provision production credentials, the recipient certificate, an off-host replication destination, or restore-drill evidence. Those remain explicit operator gates before launch.

Validation

• scripts/validate-postgres-config.sh
• scripts/validate-jotwink-config.sh
• scripts/test-jotwink-backup.sh
• shell syntax validation for repository scripts
• staged diff and secret-pattern checks