anca-elements: weekly local mirror sdc → sda (replaces Synology as 2nd copy)

Synology is being removed as a host for the Anca/Elements archive
(770G). /srv/nfs/anca-elements on PVE becomes the source of truth;
sda /mnt/backup/anca-elements becomes the single-disk-failure mirror.
No offsite for this archive — by design.

- scripts/anca-elements-mirror.sh: rsync -rlt --delete -H, idempotent,
  pushes anca_elements_mirror_last_{run_timestamp,status,bytes} to
  Pushgateway, lockfile in /run, SIGTERM-safe (status=2 on abort).
- .service: oneshot, Nice=10, IOSchedulingClass=idle, 5h timeout.
- .timer: weekly Mon 04:00, Persistent=true, 15-min randomised delay.

Deployed to PVE host; timer enabled; initial 770G sync running in
background. Synology original to be deleted after first run completes
and parity is verified.

docs/architecture/backup-dr.md: documents Layer 3a + updated path
exclusion rationale (PVE is now upstream, not downstream).

scripts/anca-elements-mirror.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Mirror /srv/nfs/anca-elements to /mnt/backup (single-disk-failure protection)
+After=network-online.target local-fs.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/anca-elements-mirror
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=anca-elements-mirror
+# Big sustained IO — don't compete with foreground services.
+Nice=10
+IOSchedulingClass=idle
+TimeoutStartSec=18000