RAILIANCE-WP-0016: promote active; inventory and activity-core cutover prep

Mark workplan active with T01/T02 done, document topology, extend status
for activity-core mode, and wire Make targets to the platform multi-host
backup CLI. T03 remains operator-blocked on ESO token.

docs/cnpg-backup-topology-inventory.md

@@ -0,0 +1,43 @@
+# CNPG backup topology inventory
+
+**Workplan:** RAILIANCE-WP-0016-T01  
+**Recorded:** 2026-07-22  
+**Method:** live `kubectl get cluster` + `psql` datname listing on both hosts.
+
+## Hosts
+
+| Host | Kubeconfig (operator workstation) | API |
+| --- | --- | --- |
+| CoulombCore | `~/.kube/config` | tunnel `k3s-api-coulombcore` |
+| railiance01 | `~/.kube/config-hosteurope` | local / hosteurope |
+
+## Production-of-record (POR) decisions
+
+| Target id | Host | Cluster | Databases | POR? | Consumer / notes |
+| --- | --- | --- | --- | --- | --- |
+| `core-apps-pg` | CoulombCore | `apps-pg` | `apps_meta`, `core_hub`, `core_hub_staging`, `vergabe_db` | **Yes** | S5 apps (vergabe, core-hub) — only instance |
+| `core-gitea-db` | CoulombCore | `gitea-db` | `gitea` | **Yes** | Legacy Gitea; still live |
+| `r01-forgejo-db` | railiance01 | `forgejo-db` | `forgejo` | **Yes** | Forgejo production — only instance |
+| `core-net-kingdom-pg` | CoulombCore | `net-kingdom-pg` | `interhub`, `privacyidea_db` | **Yes (dual)** | Backup both until app DSN audit confirms single host |
+| `r01-net-kingdom-pg` | railiance01 | `net-kingdom-pg` | `interhub`, `privacyidea_db`, `probe` | **Yes (dual)** | Extra `probe` DB on R01 only |
+| `core-state-hub-db` | CoulombCore | `state-hub-db` | `state_hub` | **Yes (dual)** | Hub may run against either instance historically |
+| `r01-state-hub-db` | railiance01 | `state-hub-db` | `state_hub` | **Yes (dual)** | activity-core / local hub proximity |
+
+### Dual-host policy
+
+Until a consumer DSN audit proves a single POR for Net Kingdom and State Hub:
+
+- **Backup both** Core and R01 instances (different Nextcloud prefixes:
+  `core-*` vs `r01-*`).
+- Restore drills must name the **host** + cluster, not only the DB name.
+
+## Out of backup scope (this workplan)
+
+- CNPG system DB `postgres`
+- Temporary drill DBs
+- App media PVCs (vergage media disabled)
+
+## Runner mapping
+
+Implemented in `railiance-platform/tools/cmd/cnpg-option-a-backup` default target
+list. Override with `CNPG_BACKUP_TARGETS=core-apps-pg,r01-forgejo-db`.