WP-0013/0014: warden credential routing, CoulombCore kubeconfig, apps-pg backup dry-run

Document OpenBao/warden paths for the offsite backup lane and flag the sealed
Vault blocker. Point production Makefile targets at CoulombCore, auto-discover
CNPG clusters in backup status, add apps-pg pg_dump dry-run tooling, and
record Core Hub Helm cutover findings (live gitea image, adopt required).

tools/apps-pg-backup-dry-run.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# Phase 1 logical backup for apps-pg consumer databases (Option A lane).
+# Encrypts locally with age; Nextcloud upload requires OpenBao offsite-lane creds.
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+PLATFORM_REPO="${PLATFORM_REPO:-$HOME/railiance-platform}"
+COMMON_SH="${PLATFORM_REPO}/lib/railiance-backup-common.sh"
+
+APPS_PG_NAMESPACE="${APPS_PG_NAMESPACE:-databases}"
+APPS_PG_CLUSTER="${APPS_PG_CLUSTER:-apps-pg}"
+APPS_PG_POD="${APPS_PG_POD:-}"
+APPS_PG_DATABASE="${APPS_PG_DATABASE:-vergabe_db}"
+BACKUP_DIR="${BACKUP_DIR:-$HOME/.cache/railiance/backups/apps-pg}"
+DRY_RUN="${RAILIANCE_BACKUP_DRY_RUN:-1}"
+
+if [[ ! -f "$COMMON_SH" ]]; then
+  echo "ERROR: missing ${COMMON_SH}" >&2
+  exit 1
+fi
+# shellcheck source=/dev/null
+source "$COMMON_SH"
+
+railiance_backup_require_tools
+mkdir -p "$BACKUP_DIR"
+
+if [[ -z "$APPS_PG_POD" ]]; then
+  APPS_PG_POD="$(
+    kubectl get pods -n "$APPS_PG_NAMESPACE" \
+      -l "cnpg.io/cluster=${APPS_PG_CLUSTER},role=primary" \
+      -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true
+  )"
+fi
+if [[ -z "$APPS_PG_POD" ]]; then
+  echo "ERROR: primary pod for ${APPS_PG_CLUSTER} not found in ${APPS_PG_NAMESPACE}" >&2
+  exit 1
+fi
+
+TS="$(date -u +%Y%m%dT%H%M%SZ)"
+DB_PLAIN="${BACKUP_DIR}/apps-pg-${APPS_PG_DATABASE}-${TS}.dump"
+DB_AGE="${DB_PLAIN}.age"
+
+echo "apps-pg backup dry-run"
+echo "  cluster: ${APPS_PG_CLUSTER}"
+echo "  pod:     ${APPS_PG_POD}"
+echo "  database:${APPS_PG_DATABASE}"
+echo
+
+kubectl exec -n "$APPS_PG_NAMESPACE" "$APPS_PG_POD" -c postgres -- \
+  pg_dump -U postgres -d "$APPS_PG_DATABASE" -Fc --no-owner --no-acl > "$DB_PLAIN"
+echo "ok: pg_dump $(du -h "$DB_PLAIN" | awk '{print $1}')"
+
+railiance_backup_encrypt "$DB_PLAIN" "$DB_AGE"
+echo "ok: age encrypted $(basename "$DB_AGE")"
+
+if [[ "$DRY_RUN" == "1" ]]; then
+  echo "ok: dry-run — skipping Nextcloud upload (OpenBao offsite-lane required)"
+  echo "     Decrypt with ~/.config/age/railiance-backup.key"
+  exit 0
+fi
+
+railiance_backup_require_openbao_lane
+RAILIANCE_BACKUP_NC_PREFIX="${RAILIANCE_BACKUP_NC_PREFIX:-apps-pg}"
+railiance_backup_nc_upload "$DB_AGE" "apps-pg-${APPS_PG_DATABASE}-${TS}.dump.age"
+railiance_backup_record_success "$BACKUP_DIR" "$TS"
+echo "ok: uploaded apps-pg-${APPS_PG_DATABASE}-${TS}.dump.age"