doc: instance leg to S3 shelved; ks2 push is the interim off-site leg

Decided 2026-08-28: instances are protected by replication (sdb now,
nuc after FTTH, ks2 push in between), their data/DBs/configs by
restic-data — a third copy of instance filesystems in S3 was not
worth the moving parts. backup-strategy.md now explains the
replication-vs-backup split and the rebuild path when no replica
survives; restic-backup.md §6 is marked SHELVED (script and empty
repo kept).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

new-container.md

@@ -67,8 +67,7 @@ them forces a full re-send of its whole disk every night.
 **Automatic, nothing to do:**
 
 - the 01:00 replica leg copies *every* instance to the `backup` pool
-  and to nuc — new instances included;
-- the S3 instance leg backs up every replica the same way;
+  and off-site — new instances included;
 - **databases are auto-discovered**: any running container with
   MariaDB/MySQL or PostgreSQL gets every non-system database dumped
   nightly, plus users/grants.