fleet-manager: add backup.sh for the durable-state volumes

Snapshot fleet-data (inventory + admins.json + enroll.key — the admin-lockout
risk) and influx-data to timestamped tarballs via a throwaway alpine container
(read-only, live-safe), with BACKUP_KEEP retention. Documented in DEPLOY.md
Backups with a restore pointer.

serving/fleet-manager/DEPLOY.md

@@ -222,6 +222,19 @@ and the `influx-data` volume. Losing `admins.json` locks every admin out — you
 re-bootstrap with `register-admin`. Losing `enroll.key` invalidates any
 outstanding (unused) enrol links.
 
+`./backup.sh [dest-dir]` tars both volumes (read-only, safe to run live) into
+timestamped `.tar.gz` files (default `./backups`, keeps the newest
+`BACKUP_KEEP=14`). Schedule it with a systemd timer / cron and copy the output
+offsite:
+
+```bash
+./backup.sh /srv/backups/fleet-manager
+# restore (manager stopped) — see the header of backup.sh
+```
+
+If you run compose under a non-default project name, pass
+`COMPOSE_PROJECT_NAME=<name>` so it finds the `<name>_fleet-data` volume.
+
 ## Troubleshooting
 
 - **`permission denied` writing the inventory on approve** — the runtime image is