dooplex-offsite: nightly encrypted copy of Gitea + DooPlex secrets to ep0, restore test, failure mail (R-232 b/h)

Part A plan + readings, Part E read-backs (R-861 a, R-518) in audits/dooplex-survival-2026-10-09/.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/hub-db-backup/felhom-hub-db-backup.service

@@ -3,6 +3,7 @@
 Description=Felhom: push the hub DB snapshot to ep0 (R-173)
 Wants=network-online.target felhom-ep0-pbs-tunnel.service
 After=network-online.target felhom-ep0-pbs-tunnel.service
+OnFailure=felhom-backup-failmail@%n.service
 
 [Service]
 Type=oneshot

scripts/hub-db-backup/felhom-hub-db-restore-test.service

@@ -3,6 +3,7 @@
 Description=Felhom: restore-test the hub DB copy on ep0 (R-173)
 Wants=network-online.target felhom-ep0-pbs-tunnel.service
 After=network-online.target felhom-ep0-pbs-tunnel.service
+OnFailure=felhom-backup-failmail@%n.service
 
 [Service]
 Type=oneshot