Provision BetaCrew databases and encrypted backups

[kaanyagci]

Summary

• add idempotent, advisory-locked BetaCrew app and Keycloak database bootstrap
• reject plaintext and source-restrict both roles through the deployed HBA policy
• add an isolated six-hour encrypted backup service and guarded restore verifier
• document the dedicated roles, paths, retention, and restore drill

Validation

• bash scripts/validate-betacrew-config.sh
• bash scripts/test-betacrew-backup.sh
• bootstrap executed twice against PostgreSQL 16, including password rotation
• docker compose --env-file envs/production/.env.db -f compose.host.yml config

This PR intentionally targets PR #6's codex/jotwink-databases host deployment rather than stale main.