feat: backup + preflight commands, decisions log, gitignore update

- tools/cmd/railiance-backup: pg_dump + config snapshot, age-encrypted,
  uploaded to Nextcloud file drop via curl PUT. Daily cron target.
- tools/cmd/railiance-preflight: pre-migration safety gate — checks backup
  freshness, all repos clean/pushed, age key present.
- bin/railiance: added backup and preflight subcommands.
- DECISIONS.md: decision log (D1 ingress Nginx+Traefik, D2 Nextcloud backup).
- .gitignore: exclude *backup-dropoff-link* files (contain upload tokens).
- CLAUDE.md: state hub session protocol update.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitignore

@@ -69,6 +69,9 @@ htmlcov/
 # (token + credentials must *never* be committed)
 .railiance_gitea.conf
 
+# Backup dropoff links (contain upload tokens)
+*backup-dropoff-link*
+
 # IDE configs
 .vscode/
 .idea/