feat: add per-database backups for PostgreSQL and MySQL

Add separate CronJobs that dump each database individually:
- postgresql-backup-per-db: pg_dump -Fc per DB (daily 00:15)
- mysql-backup-per-db: mysqldump per DB (daily 00:45)

Dumps go to /backup/per-db/<dbname>/ on the same NFS PVC.
Enables single-database restore without affecting other databases.
Also fixed CNPG superuser password sync and added --single-transaction
--set-gtid-purged=OFF to MySQL per-db dumps.

Updated restore runbooks with per-database restore procedures.

[ci skip]

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/runbooks/restore-mysql.md

@@ -96,6 +96,38 @@ kubectl exec -it mysql-cluster-0 -n dbaas -c mysql -- mysqlsh root@localhost --p
 kubectl exec -it mysql-cluster-0 -n dbaas -c mysql -- mysqlsh root@localhost --password="$ROOT_PWD" -- cluster rejoinInstance root@mysql-cluster-1:3306
 ```
 
+## Restore Single Database (from per-db backup)
+
+Per-database backups are stored at `/mnt/main/mysql-backup/per-db/<dbname>/` as gzipped SQL dumps.
+
+### 1. List available per-db backups
+```bash
+ls -lt /mnt/main/mysql-backup/per-db/<dbname>/
+```
+
+### 2. Restore a single database
+```bash
+# Port-forward to MySQL
+kubectl port-forward svc/mysql -n dbaas 3307:3306 &
+ROOT_PWD=$(kubectl get secret cluster-secret -n dbaas -o jsonpath='{.data.ROOT_PASSWORD}' | base64 -d)
+
+# Restore single database (this replaces only the target database)
+zcat /path/to/per-db/<dbname>/dump_YYYY_MM_DD_HH_MM.sql.gz | mysql -u root -p"$ROOT_PWD" --host 127.0.0.1 --port 3307 <dbname>
+```
+
+### 3. Verify
+```bash
+mysql -u root -p"$ROOT_PWD" --host 127.0.0.1 --port 3307 -e \
+  "SELECT TABLE_NAME, TABLE_ROWS FROM information_schema.TABLES WHERE TABLE_SCHEMA='<dbname>' ORDER BY TABLE_ROWS DESC LIMIT 10;"
+```
+
+### 4. Restart the affected service only
+```bash
+kubectl rollout restart deployment -n <namespace>
+```
+
+**Advantages over full restore**: Only the target database is affected. All other databases continue running with their current data.
+
 ## Alternative: Restore from sda Backup
 
 If TrueNAS NFS is unavailable but the PVE host is accessible:

docs/runbooks/restore-postgresql.md

@@ -84,6 +84,43 @@ kubectl rollout restart deployment -n linkwarden
 # ... repeat for all PG-dependent services (excluding trading — disabled)
 ```
 
+## Restore Single Database (from per-db backup)
+
+Per-database backups use `pg_dump -Fc` (custom format) and are stored at `/mnt/main/postgresql-backup/per-db/<dbname>/`.
+
+### 1. List available per-db backups
+```bash
+ls -lt /mnt/main/postgresql-backup/per-db/<dbname>/
+
+# Or via a pod:
+kubectl exec -n dbaas pg-cluster-1 -c postgres -- ls -lt /backup/per-db/<dbname>/ 2>/dev/null || \
+  echo "Mount a backup pod — see Option A below"
+```
+
+### 2. Restore a single database
+```bash
+# Port-forward to the CNPG primary
+kubectl port-forward svc/pg-cluster-rw -n dbaas 5433:5432 &
+
+# Restore single database (drops and recreates objects in that DB only)
+PGPASSWORD=$(kubectl get secret pg-cluster-superuser -n dbaas -o jsonpath='{.data.password}' | base64 -d) \
+  pg_restore -h 127.0.0.1 -p 5433 -U postgres -d <dbname> --clean --if-exists \
+  /path/to/per-db/<dbname>/dump_YYYY_MM_DD_HH_MM.dump
+```
+
+### 3. Verify
+```bash
+PGPASSWORD=$PGPASSWORD psql -h 127.0.0.1 -p 5433 -U postgres -d <dbname> -c \
+  "SELECT schemaname, tablename, n_live_tup FROM pg_stat_user_tables ORDER BY n_live_tup DESC LIMIT 10;"
+```
+
+### 4. Restart the affected service only
+```bash
+kubectl rollout restart deployment -n <namespace>
+```
+
+**Advantages over full restore**: Only the target database is affected. All other databases continue running with their current data.
+
 ## Alternative: Restore from sda Backup
 
 If TrueNAS NFS is unavailable but the PVE host is accessible: