feat: backup + preflight commands, decisions log, gitignore update

- tools/cmd/railiance-backup: pg_dump + config snapshot, age-encrypted,
  uploaded to Nextcloud file drop via curl PUT. Daily cron target.
- tools/cmd/railiance-preflight: pre-migration safety gate — checks backup
  freshness, all repos clean/pushed, age key present.
- bin/railiance: added backup and preflight subcommands.
- DECISIONS.md: decision log (D1 ingress Nginx+Traefik, D2 Nextcloud backup).
- .gitignore: exclude *backup-dropoff-link* files (contain upload tokens).
- CLAUDE.md: state hub session protocol update.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

bin/railiance

@@ -19,6 +19,8 @@ Commands:
   build-spore   Build a distributable "Spore" bundle
   seed-local    Run the seed script on this machine
   checklist     Pre-VM checklist
+  backup        Backup postgres + config to Nextcloud (age-encrypted)
+  preflight     Pre-migration safety gate (must pass before cluster work)
   help          Show this help
 EOF
 }
@@ -54,5 +56,7 @@ Rent-a-VM Checklist
 CK
     ;;
   next) cat "$ROOT/QUICKSTART.md" ;;
+  backup)    exec railiance-backup    "$@" ;;
+  preflight) exec railiance-preflight "$@" ;;
   *) echo "Unknown command: $cmd" >&2; usage; exit 2 ;;
 esac