Backups: strategy, encryption, and retention reconciliation #12

Context

Deliberately deferred during the Phase 5 plan review, recorded there as an explicit compliance gap. Not yet addressed anywhere.

The gap

There is no backup path in this repo at all — no pg_dump, no volume snapshot, no MinIO replication, nothing under infra/.

Encryption at rest is a hard compliance requirement for this project (Phase 5, #9). But an encrypted PVC whose nightly backup lands unencrypted on other media is a textbook at-rest finding. Encrypting the live volume while leaving backups in the clear satisfies the letter of the control and misses its point entirely.

Right now there is no backup to encrypt — which is also a problem: a 10-year-lifecycle system with no recovery story.

Scope

1. Decide the mechanism: pg_dump CronJob vs. volume snapshots vs. streaming replication. Different failure/recovery profiles; pick deliberately and write down why.
2. Encrypt backups at rest, with key management that does not just relocate the problem. Note docs/SECURITY.md states no KMS in v1 and documents Vault as the upgrade path — revisit whether that still holds once backups exist.
3. MinIO object backups once document storage lands (Backups: strategy, encryption, and retention reconciliation #12).
4. Retention interaction — easy to get wrong: Phase 4b purges expired conversations from the live DB. If backups sit outside that policy, purged data survives in them, quietly defeating the retention guarantee. Backup retention must be reconciled with docs/SECURITY.md's policy table, not designed independently.
5. Restore verification. An untested backup is not a backup. Automate a restore check.
6. Air-gap constraint: no cloud backup targets. Everything stays on-prem.

Standards

AGENTS.md. Time-dependent logic must use the injected-now pattern (docs/TIME_INJECTION.md) — backup retention math is exactly the shape that pattern exists for.

Done when

Backups exist, are encrypted, their retention is reconciled with the data-retention policy, and a restore has been verified end to end.