Verify, alert, and run unattended

Make the backups trustworthy and hands-off.

• Verify an archive without a full restore by streaming the whole ciphertext through age so the MAC actually catches truncation.
• Notify on every run via a Discord webhook (success and failure).
• Prevent overlapping runs (flock) and schedule the nightly cron.
• Run a scheduled restore drill.
• Document install + the restore runbook.

Done when: a nightly cron fires on schedule (overlap-protected), a notification lands on every run, bur verify flags a bad archive, the drill restores into throwaway containers, and the README is up to date.