Add three-scenario disaster recovery

config/disaster-backup.env.example

@@ -0,0 +1,18 @@
+# Root-only configuration for the encrypted off-host Restic repository.
+# Copy to /etc/mike-ai/disaster-backup.env and chmod 600.
+#
+# Recommended: mount an Unraid backup share at /mnt/athena-offsite and use:
+RESTIC_REPOSITORY=/mnt/athena-offsite/restic
+RESTIC_REQUIRE_MOUNT=/mnt/athena-offsite
+
+# The password file must ALSO exist outside Athena (password manager/offline
+# recovery USB). Without it a total-loss backup cannot be decrypted.
+RESTIC_PASSWORD_FILE=/root/athena-restic-password
+
+RESTIC_TAG=athena-disaster
+RESTIC_KEEP_DAILY=14
+RESTIC_KEEP_WEEKLY=8
+RESTIC_KEEP_MONTHLY=12
+
+# Set true only after the repository and credentials have been tested.
+DISASTER_BACKUP_ENABLED=false