docs: add full homelab documentation structure

docs/operations/BACKUP_POLICY.md

@@ -0,0 +1,42 @@
+# Backup Policy
+
+## Current State (Known Gaps)
+- **No off-site backup** — this is a known gap, improvement pending
+- Serenity has local ZFS snapshots and replication
+- PlausibleDeniability has no automated backup of appdata or databases
+
+## Serenity Backup Strategy
+- Sanoid snapshots cache/appdata: 7 daily, 4 weekly, 6 monthly
+- Syncoid replicates cache/appdata → malcolm/zfs_backups_array (strict-mirror)
+- qBit Mover script: pauses torrents 0–4 days old then runs Unraid mover
+- Mover Status script: sends Discord webhook notifications
+
+## PlausibleDeniability Backup Scope
+Back up at minimum:
+- Compose repo: `/mnt/docker-ssd/docker/compose` (in git — GitHub + Gitea)
+- Local SSD appdata: `/mnt/docker-ssd/docker/appdata/`
+- Databases: `/mnt/docker-ssd/docker/databases/`
+- Selected appdata/backups on tank: `/mnt/tank/docker/`
+- .env files (separately — gitignored, handle via encrypted backup or private repo)
+
+## Database Backups
+- Keep app-consistent dumps for major databases
+- Do not rely only on raw volume copies for restores
+- Document restore procedure per major service
+
+Recommended dump locations: `/mnt/tank/docker/backups/db-dumps/`
+
+## .env File Backup Options
+1. **Private Gitea repo** — short term, push all .env files to a private repo on your local Gitea
+2. **Encrypted restic** — include .env files in restic backup with encryption, push offsite (Backblaze B2)
+3. **Vaultwarden** — store each .env as a secure note (best long-term once deployed)
+
+## Restore Practice
+- Test restores quarterly
+- Test at least one app DB restore and one full-config restore
+- Verify that restored stacks can start with current compose files
+
+## Operational Notes
+- Media libraries on Unraid are large and may not need the same backup frequency as configs/databases
+- SSD-local DB and SQLite workloads are highest priority for backup validation
+- Serenity malcolm pool is heavily utilized — capacity planning needed before it fills