Establish railiance backup credentials in OpenBao (CCR-2026-0004).

Add workload KV lane for Nextcloud WebDAV token, URL, and age recovery
escrow at platform/workloads/railiance/backup/offsite-lane. Apply read
policy and OIDC role railiance-backup-workload-kv-read; wire forgejo-backup
to load credentials from OpenBao when env is unset.

docs/forgejo-backup.md

@@ -0,0 +1,61 @@
+# Forgejo backup (railiance01)
+
+Workplan: `RAIL-HO-WP-0005` T04/T09 · Decision: Option A (Nextcloud + age)
+
+## What is backed up
+
+| Artifact | Source | Format |
+| --- | --- | --- |
+| Blob state | `forgejo dump` in production pod | zip → age |
+| PostgreSQL | `pg_dump -Fc` from CNPG `forgejo-db` | custom dump → age |
+
+Covers git repos, packages (OCI/npm/generic), attachments, LFS, avatars, and DB metadata.
+
+## Operator commands
+
+```bash
+cd ~/railiance-platform
+make forgejo-backup-dry-run    # local encrypt only, no upload
+make forgejo-backup            # encrypt + upload to Nextcloud forgejo/
+make forgejo-backup-status     # last success + 7-day gate hint
+```
+
+Requires: `kubectl`, `age`, `curl`, `KUBECONFIG=~/.kube/config-hosteurope`.
+
+Decrypt: `~/.config/age/railiance-backup.key` (same key as other Railiance backups).
+
+## Nextcloud layout
+
+```
+forgejo/forgejo-dump-<timestamp>.zip.age
+forgejo/forgejo-db-<timestamp>.sql.age
+forgejo/forgejo-dump-weekly-<timestamp>.zip.age   # Sundays only
+forgejo/forgejo-db-weekly-<timestamp>.sql.age
+```
+
+Retention target: **14 daily + 4 weekly** on Nextcloud (operator may prune old
+objects in the WebDAV folder; local cache keeps 7 per type).
+
+## Cron (workstation)
+
+```cron
+# Daily 02:15 UTC — Forgejo backup (RPO 24h)
+15 2 * * * cd $HOME/railiance-platform && make forgejo-backup >>$HOME/.cache/railiance/backups/forgejo/cron.log 2>&1
+```
+
+## Promotion gate (tier-3 cutover)
+
+Do not promote further production repos until:
+
+1. `make forgejo-backup` succeeds **7 consecutive days** (check `success-log`).
+2. One restore drill uses a Nextcloud artifact (not `/tmp/forgejo-drill/`).
+
+## Restore
+
+See `railiance-infra`:
+
+- `tools/forgejo-restore-drill.sh`
+- `docs/forgejo-restore-drill-evidence.md`
+
+Download and decrypt a dump from Nextcloud, set `BACKUP_LOCAL` to the zip path,
+then run the drill script.