reliability: AWS Backup plan + restore drill + RPO/RTO doc

[jonmatum]

Priority: P0 — launch blocker
Parent: #34
Promotes: REL-2 from #28

Context

DynamoDB PITR is enabled (35-day window), but there is no AWS Backup plan, no documented RPO/RTO, and no one has ever restored the table from a backup. "We have PITR" is not a disaster recovery strategy.

Requirements

Backup plan (Terraform)

• aws_backup_vault, aws_backup_plan with daily full + hourly incremental, 30-day retention, copied to a second region (optional for v1)
• Selection covers the DynamoDB main table and the content S3 bucket

RPO / RTO

• Publish docs/ops/dr.md stating target RPO (e.g. 1 h) and RTO (e.g. 4 h)
• Map each failure class (accidental delete, corruption, region outage) to the recovery procedure

Restore drill

• Execute a PITR restore to a scratch table, run smoke test against it, document wall-clock time
• Record results in docs/ops/dr-drill-YYYY-MM-DD.md
• Schedule a repeat drill annually

Acceptance criteria

• Backup plan applied in both environments
• dr.md committed with real measured RPO/RTO
• At least one successful restore drill logged

References

• Production readiness — consolidated plan (tracking) #34 (parent)
• AWS Well-Architected Framework assessment — gaps and remediation plan #28 REL-2