feat(backup): add rsync --link-dest off-host transport, restore docs

backup.sh now supports BACKUP_REMOTE_RSYNC alongside BACKUP_REMOTE.
The rsync path writes <root>/YYYY-MM-DD/<archive> on the target with
--link-dest pointing at the previous day's directory, so unchanged
archives become hard links and daily snapshots cost almost zero
extra bytes. BACKUP_REMOTE_SSH_KEY routes the rsync ssh leg to a
dedicated identity (e.g. rsync.net restricted accounts).

Timer moved to 03:00 Europe/Berlin (was 03:17 UTC) per #41.

docs/operations.md: full restore procedure (parallel stack first,
then atomic swap) plus the rsync vs rclone trade-off. Closes most
of #41 — the only remaining task is the operator's choice of
off-host target.

scripts/librenotes-backup.timer

@@ -2,9 +2,10 @@
 Description=Run librenotes backup nightly
 
 [Timer]
-# 03:17 UTC nightly with up to 5min jitter so multiple machines on
-# the same schedule don't all hit the off-site target at once.
-OnCalendar=*-*-* 03:17:00 UTC
+# 03:00 Europe/Berlin nightly with up to 5min jitter so multiple
+# machines on the same schedule don't all hit the off-site target
+# at once.
+OnCalendar=*-*-* 03:00:00 Europe/Berlin
 RandomizedDelaySec=5min
 Persistent=true
 Unit=librenotes-backup.service