feat(s2): add Gitea SSH NodePort service + close WP-0004 (backup tool, scope updates)

- helm/gitea-ssh-nodeport.yaml: expose Gitea SSH on NodePort 30022 (targetPort 2222)
  for on-node git automation (RAIL-HO-WP-0004-T07)
- tools/cmd/railiance-backup-s2: fix SQLite hot backup (was broken etcd-snapshot)
- tools/cmd/railiance-restore-s2: update restore instructions for SQLite mode
- workplans/RAIL-BS-WP-0004-safety-net.md: mark done
- SCOPE.md: update current state, document boundary violations, fix connectivity docs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

helm/gitea-ssh-nodeport.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-ssh-nodeport
+  namespace: default
+  labels:
+    app.kubernetes.io/name: gitea
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: manual
+  annotations:
+    note: "Exposes Gitea SSH for on-node git automation. Not managed by Helm chart. See RAIL-HO-WP-0004-T07."
+spec:
+  type: NodePort
+  selector:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/name: gitea
+  ports:
+    - name: ssh
+      port: 22
+      targetPort: 2222
+      nodePort: 30022
+      protocol: TCP