doc: add backup-strategy.md and new-container.md for non-specialist readers

backup-strategy.md: the two-tool architecture (incus copy + restic),
ASCII map of the legs (ks4 sdb / nuc pull / two S3 buckets), the
schedule table, a 30-second health check, and restore recipes for a
file, a database and a whole instance.

new-container.md: conventions for adding a service — one container
per service, no Docker (incus runs OCI natively, incus-compose for
stacks), gateway/proxy ingress, leave the snapshot schedule alone,
what the backups pick up automatically vs the one line to add to
restic-paths, DB-discovery requirements (incl. the .my.cnf trap), a
verification run, and the pitfalls (tmpfs /tmp, tiny-file swarms,
cron PATH).

README: start-here links, ks4 durability bullet and flow chart
updated to the restic era.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -2,6 +2,11 @@
 
 Personal infrastructure notes.
 
+**Start here**: [backup-strategy.md](backup-strategy.md) — what is
+backed up, by which tool, on what schedule, and how to restore.
+[new-container.md](new-container.md) — conventions for adding a
+service to ks4 (and getting it backed up automatically).
+
 - [`nuc/`](nuc/) — home lab on `nuc` (see below)
 - [`ks4/`](ks4/) — prod server `ks4` at OVH (see below)
 - [`ks2/`](ks2/) — legacy backup server being decommissioned
@@ -61,15 +66,14 @@ Incus host at OVH — public-facing self-hosted services.
   outline, login (SSO), wireguard, + more — full table in
   [ks4/install.md](ks4/install.md).
 - ⚠️ The ZFS `data` pool is single-disk (not mirrored); durability
-  rests on nightly root cron jobs — 01:00 `incus copy --refresh` of
-  all instances to the local `backup` pool on sdb5
+  rests on nightly cron jobs — 01:00 `incus copy --refresh` of all
+  instances to the local `backup` pool on sdb5, then the instance leg
+  to S3; 05:00 restic (DB dumps + data trees) to S3; nuc pulls the
+  replicas over WireGuard. Full picture and restore procedures:
+  **[backup-strategy.md](backup-strategy.md)**
   ([ks4/local-backup-cron.md](ks4/local-backup-cron.md),
-  [ks4/incus-copy.md](ks4/incus-copy.md)), 04:30 plakar backups
-  (DB dumps + data trees) to S3
-  ([ks4/plakar-s3-data.md](ks4/plakar-s3-data.md)), plus during the
-  transition a 04:00 rsync stopgap to ks2
-  ([ks2 decommission plan](ks2/plan.md)); a pull leg to nuc pool
-  `ks4backup` awaits FTTH.
+  [ks4/incus-copy.md](ks4/incus-copy.md),
+  [ks4/restic-backup.md](ks4/restic-backup.md)).
 
 ## Network flows (nuc <-> ks4)
 
@@ -90,10 +94,11 @@ Incus host at OVH — public-facing self-hosted services.
 |                                   |       |                                     |
 | 03:00 instance snapshots          |       | 03:00 instance snapshots            |
 | 03:30 incus-copy: all instances   |       | 01:00 incus-copy: all instances     |
-|   -> project backup, pool         |       |   -> project backup, zpool          |
-|   nucbackup (usb4t/backup/nuc)    |       |   backup (sdb5)          [planned]  |
-| 05:00 apt upgrade all containers  |       | 04:00 incus-backup.sh: DB dumps     |
-|                                   |       |   -> /backup (sdb5)      [planned]  |
+|   -> project backup, pool         |       |   -> project backup, zpool sdb5     |
+|   nucbackup (usb4t/backup/nuc)    |       |   then restic instance leg -> S3    |
+| 05:00 pull ks4:* -> ks4backup     |       | 05:00 restic: DB dumps + data       |
+|   [pending FTTH]                  |       |   trees -> S3 (restic-data)         |
+| 05:30 apt upgrade all containers  |       | Sun 14:00 restic maintenance        |
 +-----------------------------------+       +-------------------------------------+
    phones/laptops: WG peers 10.8.0.2-3 reach 192.168.1.x through the same endpoint
 ```
@@ -106,6 +111,10 @@ fixed endpoint; ks4's incus API is never exposed to the internet.
 - One markdown file per instance in `nuc/`, containing the full
   install script (idempotent-ish, run as root on the host), first-run
   configuration, and troubleshooting notes.
-- Containers are built from `images:ubuntu/24.04` and configured
+- Containers are built from Debian/Ubuntu images and configured
   exclusively through `incus exec`/`incus config` so the doc is the
   single source of truth — rebuilding = re-running the script.
+- Adding a service to ks4: follow
+  [new-container.md](new-container.md) (no Docker in containers —
+  incus runs OCI images natively and `incus-compose` handles stacks;
+  data paths go into `scripts/restic-paths`).