fix(backup): provide consistent Coroot ClickHouse recovery on hcloud

[devantler]

🤖 Generated by the Agentic Engineer

Coroot ClickHouse volumes on hcloud inherit Velero’s live Kopia filesystem backup path. ClickHouse can merge or remove parts while that traversal runs, so this does not provide a dependable application-consistent recovery source. The current recovery documentation broadly promises PVC recovery and needs to state this limitation until a replacement is proven.

The public source records the current storage and backup contract:

• Backup methods and fail-safe FSB routing.
• Coroot production configuration.
• Native ClickHouse backup and restore.

Implement an additive native ClickHouse-to-R2 backup path, using the existing backup credential source and a dedicated Secret. Scope R2 egress to ClickHouse identities because the database servers perform the upload. Keep the current data coverage and failure reporting while proving the replacement. Merge-stop hooks alone do not establish a consistent whole-volume capture; FREEZE also needs metadata capture and a separate restore procedure.

Acceptance criteria:

• Bind the implementation to the actual SQL database/table/replica inventory and backup privileges.
• Unique backup locations, bounded completion checks, overlap prevention, and explicit BACKUP_CREATED verification; no credentials in logs.
• Successful backup during active ingestion and merges, followed by restore into isolated empty ClickHouse/Keeper with schema, data, and Coroot-query checks.
• Preserve the documented 24-hour recovery-point target and retention when handing off raw-PVC coverage.
• Detect partial backup failure independently of controller/repository readiness.
• Update the recovery documentation and require consecutive scheduled successes before declaring recovery coverage restored.