fix: technitium CronJob scheduling, LUKS backup support, speedtest scrape

- technitium-password-sync: remove RWO encrypted PVC mount that caused
  pods to stick in ContainerCreating on wrong nodes. Plugin install now
  warns instead of failing when zip unavailable.
- daily-backup: add LUKS decryption support for encrypted PVC snapshots
  using /root/.luks-backup-key. Uses noload mount option to skip ext4
  journal replay. Also installed cryptsetup-bin on PVE host.
- speedtest: disable prometheus.io/scrape annotation (no /prometheus
  endpoint exists, causing ScrapeTargetDown alert).

[ci skip]

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

stacks/speedtest/main.tf

@@ -206,9 +206,7 @@ resource "kubernetes_service" "speedtest" {
       "app" = "speedtest"
     }
     annotations = {
-      "prometheus.io/scrape" = "true"
-      "prometheus.io/path"   = "/prometheus"
-      "prometheus.io/port"   = "80"
+      "prometheus.io/scrape" = "false"
     }
   }