[main]: Update home-server

docs/home-server/backups.md

@@ -10,6 +10,8 @@ sources:
     reference: "Backrest plan JSON, destination, key custody and no restore test, 2026-10-06"
   - kind: owner-report
     reference: "Updated four-service Backrest plan and deployed Portainer bind mount/container name, 2026-10-06"
+  - kind: owner-report
+    reference: "Only restic key has independent custody; no independent credential recovery or backup/restore evidence, 2026-10-06"
   - kind: repository
     repository: jupiter-stacks
     revision: 610e325ef6a98850511ce7a089b0b9a77bfecf15
@@ -18,12 +20,11 @@ sources:
       - stacks/gitea/docker-compose.yml
       - stacks/paperless-ngx/docker-compose.yml
       - stacks/vaultwarden/docker-compose.yml
-related: [home-server.reference, home-server.storage, home-server.portainer, home-server.authentication]
+related: [home-server.reference, home-server.storage, home-server.portainer, home-server.authentication, home-server.operations]
 update_triggers: [backup-plan-change, destination-change, hook-change, credential-change, restore-test]
 unknowns:
   - last-successful-backup-and-repository-check
-  - google-drive-repository-path-and-credential-recovery
-  - off-host-backrest-config-recovery
+  - google-drive-repository-path
   - measured-rpo-and-rto
 ---
 
@@ -36,6 +37,8 @@ unknowns:
 | Schedule | `0 3 * * *`; UTC; daily 03:00 |
 | Retention | `policyKeepLastN: 4`; last four snapshots, not four days |
 | Encryption key | iCloud password app; no key stored here |
+| Independent credential recovery | None beyond the restic encryption key |
+| Backup / integrity evidence | None supplied |
 | Restore test | Never performed |
 
 ## Coverage
@@ -92,4 +95,7 @@ Traefik, Backrest configuration, Docker named volumes, OS, or Mercury.
 
 Full-host recovery requires independently retrievable repository credentials,
 configuration and restic key. Key custody alone does not establish recoverability.
+No independent Google Drive/rclone credential recovery or Backrest-config
+recovery arrangement exists. Recovering backed-up Portainer state is not a
+substitute for first being able to retrieve the backup.
 `/restore` is on the same RAID array; not an independent backup.