docs(wiki): settle on-site encrypted backup + disaster-recovery design

New concept page backup-recovery.md resolving the design half of open-question #5.
Driving scenario: a stolen/destroyed PC whose LUKS+TPM disk is unrecoverable by
design — recovery stands up a NEW PC, restores a backup, and keeps signing the
SAME chain.

Settled: admin-driven encrypted full-DB backup (SQLite online-backup/VACUUM INTO,
snapshots included) to local/USB, SMB/NFS, or SFTP targets; manual button + an
in-process daily timer; keep-last-N + dailies retention; restore is admin-only /
out-of-band (operator-adversary surface). A restored copy must still verifyChain.

Key custody (the load-bearing decision, bears on #6): three independent keys —
EVENT_SIGNING_KEY kept an extractable, escrowed software key DECOUPLED from the
TPM so the ledger survives total hardware loss (the conscious trade: a TPM-sealed
signing key would be unforgeable but permanently unverifiable after the machine
dies); a NEW dedicated park_buzi_backup_key in Komodo for backup encryption,
separate from the signing key; the LUKS/TPM disk key, appliance-only and
deliberately non-recoverable. Keys are never inside the backup they unlock.

Updated open-questions #5 (design SETTLED) + #10 note; disk-os-hardening deploy
runbook (why the signing key is not sealed + park_buzi_backup_key); index catalog
+ concept count. Design only — not yet built.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/concepts/disk-os-hardening.md

@@ -2,7 +2,7 @@
 type: concept
 tags: [parking, security, platform]
 sources: [parking-system-architecture]
-updated: 2026-06-21
+updated: 2026-06-29
 ---
 
 # Disk / OS Hardening
@@ -44,7 +44,13 @@ Env in `apps/server/.env` on the appliance (see `apps/server/.env.example`). The
 - **`JWT_SECRET`** — ≥32 random chars; the server refuses to boot without a strong one (no
   insecure default). `openssl rand -hex 32`. See [[local-jwt-auth]].
 - **`EVENT_SIGNING_KEY`** — dedicated HMAC key for the signed ledger; ≥16 chars. Falls back to
-  `JWT_SECRET` with a warning if unset — set a dedicated one before production.
+  `JWT_SECRET` with a warning if unset — set a dedicated one before production. Deliberately kept an
+  **extractable, escrowed software key (NOT TPM-sealed)** so the ledger survives total hardware loss —
+  see [[backup-recovery]] for the custody trade vs. [[open-questions]] #6.
+- **`park_buzi_backup_key`** *(planned)* — dedicated key for encrypting [[backup-recovery|DB backups]],
+  **separate** from `EVENT_SIGNING_KEY` (independent rotation; backups travel, the signing key
+  shouldn't). Both escrowed offsite in [[fleet-deployment-komodo|Komodo]]; recovery needs both, held
+  out-of-band.
 - **`COOKIE_SECURE=0`** — **REQUIRED on the plain-HTTP LAN appliance.** Auth/CSRF cookies are
   `Secure` by **default** (fail-safe). The appliance serves the SPA same-origin over **plain
   http** on the booth LAN, where a `Secure` cookie is **never sent** — so without this opt-out