Jenkinsfile, backup script, credentials

Copy the issues pipeline, simplified to one image.

• Parameters: ACTION, CONFIRM_TESTED gate, TAKE_BACKUP default true, OVERRIDE_TAG; image tag = commit short SHA; push to ghcr.io/jmmd2000/portfolio-web
• jmdd-env-prod credential holds .env; IMAGE_TAG appended on deploy
• backup.sh: pg_dump + snapshot tar to /home/james/backups/portfolio/, 90-day retention, plus a weekly cron independent of deploys