coder: autostop TTL, nightly backups, Authelia OIDC, wildcard runbook

- docker-compose: CODER_OIDC_* wired to Authelia (password login kept as break-glass)
- scripts/backup-stacks.sh + stacks-backup.timer: nightly pg_dump, Continue state, stack configs
- vault: verification items 13/14, auth-model OIDC section, limits DNS-01 runbook

q5vault/operations/verification.md

@@ -135,6 +135,35 @@ ss -ltn
 - any dev server started from a workspace or an IDE terminal must avoid every port in the AGENTS.md registry; `52222` pwiz, `52223` reserved for pwiz, `52224` cdsr and `52226` code are taken
 - loca.zone application backends bind loopback inside `51000-53000`
 
+## 1️⃣3️⃣ Autostop TTL is armed
+
+```bash
+TOKEN=$(sed -n 's/^session_token=//p' /home/loca/dev/coder/.admin-credentials)
+curl -s -H "Coder-Session-Token: $TOKEN" http://127.0.0.1:52226/api/v2/templates \
+  | python3 -c "import json,sys; [print(t['name'], t['default_ttl_ms'], t['activity_bump_ms']) for t in json.load(sys.stdin)]"
+curl -s -H "Coder-Session-Token: $TOKEN" http://127.0.0.1:52226/api/v2/users/loca/workspace/ws1 \
+  | python3 -c "import json,sys; w=json.load(sys.stdin); print(w['ttl_ms'], w['latest_build']['deadline'])"
+```
+
+- expect template `docker` at `28800000` default TTL (8h) and `3600000` activity bump (1h)
+- expect `ws1` `ttl_ms` `28800000` and a non-null `deadline` roughly 8h ahead
+- a `deadline` of `None` on a running workspace means that build predates the TTL: the schedule only attaches at build time, so `coder restart ws1 -y` is required once. `coder schedule extend` refuses with `Workspace shutdown is manual.` in that state
+- the subcommand is `coder schedule stop <ws> 8h`; there is no `override-stop` in v2.35.3
+
+## 1️⃣4️⃣ Nightly backup timer
+
+```bash
+systemctl list-timers stacks-backup --no-pager
+sudo -n systemctl start stacks-backup.service
+D=/home/loca/backups/stacks/$(date +%F)
+sudo -n gunzip -t $D/coder-db.sql.gz && sudo -n ls -l $D
+```
+
+- expect the timer `active` with a next elapse at 04:30 local, `Persistent=true` so a missed run catches up after downtime
+- expect three non-empty artifacts in the dated directory: `coder-db.sql.gz` (`pg_dump` of the Coder control plane), `continue-config.tgz` (`/home/loca/.continue`, which lives outside both projects), `stack-configs.tgz` (both stacks' config, deploy, scripts and templates)
+- artifacts are root-owned; retention keeps 14 dated directories
+- `.env`, `.admin-credentials` and `.ai-credentials` are deliberately excluded — they are keys, not data; verify with `sudo -n tar tzf $D/stack-configs.tgz | grep -c credentials` returning `0`
+
 ## 🧹 Pre-publish wiki lint gate
 
 Run this before every `build.sh` invocation, so before item 7 above. It is a gate, not a smoke test: it exits non-zero and publishes nothing.