coder: autostop TTL, nightly backups, Authelia OIDC, wildcard runbook

- docker-compose: CODER_OIDC_* wired to Authelia (password login kept as break-glass)
- scripts/backup-stacks.sh + stacks-backup.timer: nightly pg_dump, Continue state, stack configs
- vault: verification items 13/14, auth-model OIDC section, limits DNS-01 runbook

scripts/backup-stacks.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Nightly backup for the dual IDE stacks (cdsr = code-server, code = Coder v2).
+#
+# Deliberately NOT backed up: /home/loca/dev/coder/.env and
+# /home/loca/dev/coder/.admin-credentials, and
+# /home/loca/dev/code-server/.ai-credentials. Those are keys, not data. Losing
+# them is recoverable (re-bootstrap the Coder owner via container exec, re-mint
+# the LiteLLM virtual key); copying them in plaintext into a nightly archive
+# only widens the exposure surface.
+#
+# Runs as root from stacks-backup.service, so no sudo prefixes here.
+set -euo pipefail
+
+DEST="/home/loca/backups/stacks/$(date +%F)"
+mkdir -p "$DEST"
+
+# (a) Coder control-plane database
+docker compose -f /home/loca/dev/coder/docker-compose.yml exec -T database \
+  pg_dump -U coder coder | gzip > "$DEST/coder-db.sql.gz"
+
+# (b) Continue's real state (config + chat sessions live outside the project)
+tar czf "$DEST/continue-config.tgz" -C /home/loca .continue
+
+# (c) Stack configuration (source of truth for both deployments)
+tar czf "$DEST/stack-configs.tgz" --exclude .git -C /home/loca/dev \
+  code-server/config code-server/scripts code-server/deploy \
+  coder/docker-compose.yml coder/deploy coder/templates coder/config
+
+# (d) Retention: keep 14 days of dated directories
+find /home/loca/backups/stacks -maxdepth 1 -mindepth 1 -type d -mtime +14 \
+  -exec rm -rf {} +
+
+printf 'backup complete: %s\n' "$DEST"
+ls -l "$DEST"