Backup rotation notes — legacy archive host

- This host is frozen; do not schedule new dumps here.
- The .enc files use AES-256 with the infrastructure passphrase.
  It is recorded in the rotation manifest, which the rotate script
  writes as a dotfile next to the dumps in backups/ (autoindex hides it).
- creds.kdbx holds service credentials, master key with the sysadmin.