feat(t09): backup, break-glass, DR drill — NK-WP-0003-T09 done

- Apply SQLite backup CronJobs (LLDAP, Authelia, privacyIDEA) — all verified running
- Fix authelia-backup: remove scale-down/up dance; concurrent local-path PVC mount
  works on single-node k3s, sqlite3 .backup is safe for concurrent access
- Fix privacyidea-backup: add supplementalGroups: [999] so uid=1000 can read enckey
- Add allow-backup-to-kube-api NetworkPolicy (backup pod → 10.43.0.1:443)
- Create break-glass LLDAP account (net-kingdom-admins); fix ((PASS++)) set-e trap
- SQLite restore drill: LLDAP backup valid (2 users, all tables)
- verify-t08.sh: PASS=15, FAIL=0; fix counter bug + enckey PVC path (/etc/privacyidea)
- Update DR-RUNBOOK.md Authelia restore procedure
- T09 deferred: CNPG backup (needs MinIO/S3), Prometheus (needs kube-prometheus-stack)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sso-mfa/k8s/lldap/break-glass.sh

@@ -32,8 +32,8 @@ BG_DISPLAY="Break-glass Account"
 PASS_COUNT=0
 FAIL_COUNT=0
 
-ok()   { echo "  [OK]   $1"; ((PASS_COUNT++)); }
-fail() { echo "  [FAIL] $1"; ((FAIL_COUNT++)); }
+ok()   { echo "  [OK]   $1"; PASS_COUNT=$((PASS_COUNT + 1)); }
+fail() { echo "  [FAIL] $1"; FAIL_COUNT=$((FAIL_COUNT + 1)); }
 info() { echo "  [INFO] $1"; }
 
 for f in "$LLDAP_ENV" "$BG_ENV"; do