feat(t09): backup, break-glass, DR drill — NK-WP-0003-T09 done

- Apply SQLite backup CronJobs (LLDAP, Authelia, privacyIDEA) — all verified running
- Fix authelia-backup: remove scale-down/up dance; concurrent local-path PVC mount
  works on single-node k3s, sqlite3 .backup is safe for concurrent access
- Fix privacyidea-backup: add supplementalGroups: [999] so uid=1000 can read enckey
- Add allow-backup-to-kube-api NetworkPolicy (backup pod → 10.43.0.1:443)
- Create break-glass LLDAP account (net-kingdom-admins); fix ((PASS++)) set-e trap
- SQLite restore drill: LLDAP backup valid (2 users, all tables)
- verify-t08.sh: PASS=15, FAIL=0; fix counter bug + enckey PVC path (/etc/privacyidea)
- Update DR-RUNBOOK.md Authelia restore procedure
- T09 deferred: CNPG backup (needs MinIO/S3), Prometheus (needs kube-prometheus-stack)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sso-mfa/k8s/network-policies/netpol-sso.yaml

@@ -297,6 +297,30 @@ spec:
         - port: 8089
           protocol: TCP
 ---
+# ── Allow backup pod egress to Kubernetes API server ─────────────────────────
+# The authelia-backup CronJob pod (net-kingdom/component=backup) needs to call
+# kubectl scale to restore Authelia after taking the backup.
+# kube-apiserver ClusterIP: 10.43.0.1 (k3s default service CIDR)
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-backup-to-kube-api
+  namespace: sso
+spec:
+  podSelector:
+    matchLabels:
+      net-kingdom/component: backup
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 10.43.0.1/32
+      ports:
+        - port: 443
+          protocol: TCP
+
+---
 # ── Allow egress DNS (all pods) ──────────────────────────────────────────────
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy