docs: update secrets backup coverage

docs/servers/NOMAD.md

@@ -201,9 +201,11 @@ These are expected to be managed by Wings/Pelican rather than a local compose fi
 
 ### Technitium Backup Resolver
 - Live stack path: `/opt/technitium-nomad`
+- Live secrets file: `/opt/technitium-nomad/.env`
 - Resolver bind IP: `10.5.30.9`
 - Role: active DHCP-advertised backup Technitium resolver for the homelab
 - Config is refreshed from PD's live Technitium directory by the PD-side sync runner every 15 minutes
+- The live `.env` is also backed up into the encrypted PD secrets repo as `env/technitium-nomad.env`
 - Same-host checks from NOMAD to `10.5.30.9` are unreliable because the resolver sits behind macvlan networking; verify from another LAN peer instead
 
 ### MeshCore to MQTT relay

docs/servers/PLAUSIBLEDENABILITY.md

@@ -76,4 +76,3 @@ Current light-tier notes:
 ## Pending
 - Add Pangolin resource + DNS for `ai.paccoco.com`
 - Install fresh editor
-- Set up private Gitea repo for .env file backups

docs/servers/SERENITY.md

@@ -58,8 +58,10 @@ Managed via Unraid Community Apps. See Unraid dashboard for individual service p
 Serenity hosts the secondary backup Technitium node on `10.5.30.10`.
 
 - Live stack path: `/mnt/user/appdata/technitium-serenity`
+- Live secrets file: `/mnt/user/appdata/technitium-serenity/.env`
 - Resolver bind IP: `10.5.30.10`
 - Config is refreshed from PD's live Technitium directory by the PD-side sync runner every 15 minutes
+- The live `.env` is also backed up into the encrypted PD secrets repo as `env/technitium-serenity.env`
 - Same-host checks from Serenity to `10.5.30.10` are unreliable because the resolver sits behind macvlan networking; verify from another LAN peer instead
 
 ## Notes