feat(chart): scheduled backup & defrag CronJobs

[Jakob3xD]

What

Adds two opt-in chart-managed CronJobs, closing the gap between the README roadmap (which lists Scheduled snapshots and Scheduled defragmentation as delivered) and the current reality where both ship only as scripts/:

• backup.enabled — scheduled etcdctl snapshot save into an emptyDir, then upload to S3/MinIO via rclone. Retention is configurable: none (bucket lifecycle), count (keep N newest), or age (--min-age).
• defrag.enabled — scheduled defragmentation of all members via etcd-defrag (--cluster).

Both default to false → no behavior change for existing installs (default render produces zero new objects). Refs #137.

Design decisions

• rclone (MIT) instead of the MinIO client mc — mc is AGPL-3.0 and MinIO's client tooling is in maintenance mode; rclone is MIT, tiny, actively released, and configured entirely via env vars. The existing backup-storage-secret contract (storage-url, storage-access-key, storage-secret-key, storage-bucket-name, storage-bucket-folder) is unchanged.
• Defrag default rule is relative-fragmentation based — dbSizeInUse / dbSize <= 0.55 || dbQuotaUsage > 0.8. This scales with DB size, unlike the absolute > 200MiB threshold in scripts/defrag.sh which over-triggers on larger databases. Fully configurable via defrag.rule.
• Restricted-PSA compliant, non-root — runAsNonRoot, runAsUser/Group/fsGroup: 1000, seccompProfile: RuntimeDefault, readOnlyRootFilesystem: true, capabilities.drop: [ALL], automountServiceAccountToken: false, secret defaultMode: 0440. Verified that neither etcd-defrag nor etcdctl snapshot save needs root here (the upstream runAsUser: 0 example is for hostNetwork + host-path certs, which does not apply to secret-volume certs).
• No RBAC — the jobs only mount certs and talk to etcd over TLS; no Kubernetes API calls.
• Endpoints from chart helpers — respects clusterDomain and replicas (no hardcoded cluster.local); pinned image tags (rclone 1.74.4, etcd-defrag v0.41.0), never :latest.
• CronJob pods deliberately do NOT carry the etcd selector labels (app.kubernetes.io/name+instance) — otherwise the client/headless Services would route etcd client traffic to a backup/defrag pod.

Incidental fix

Moved the selfSignedCertificates/certManager mutual-exclusion guard out of _helpers.tpl into a rendered templates/validations.yaml. Helm does not execute top-level content of underscore-prefixed partials, so that guard was dead code — setting both flags true produced a broken render instead of the intended clear error. It now fires. The new backup-config validation lives in the same file.

Testing

Verified with helm lint + a helm template matrix: default (0 objects), each retention mode, cert-manager vs self-signed cert branching, custom clusterDomain, and replicas=5 endpoint scaling. helm-docs README regenerated (no CI drift).

Not yet verified on a live cluster (no cluster access from the authoring environment) — reviewers/maintainers may want to confirm:

• a real backup run uploads a valid snapshot and etcdutl snapshot status passes;
• readOnlyRootFilesystem: true doesn't break rclone/etcdctl (a /tmp emptyDir is already provisioned for rclone as a precaution);
• retention.mode=count|age prunes correctly (requires bucket delete permission).

The scripts/schedule.sh and scripts/defrag.sh helpers are retained for ad-hoc use; docs/backup.md and docs/defragmentation.md now point at the chart values as the recommended path.

---

🤖 Implemented with Claude Code.