Proxmox Backup Server on Saruman — decide what it is for before installing it

[Gerrrt]

Split out of #101.

ADR-0007 lists Proxmox Backup Server as part of the defended estate on
Saruman.

The question this has to answer first

A hypervisor backing up its own guests to itself is not a backup. If PBS
runs as a guest on Saruman and stores to Saruman's disks, then the mirrored
pair is a single point of failure for both the estate and its backups, and the
only fault it protects against is "someone broke a VM" — which is real, and is
snapshot territory, not backup territory.

That makes this issue less about installing PBS and more about deciding what it
is for:

• Snapshot-and-revert for the lab, explicitly and only. Honest, cheap, and
  worth writing down as a limitation rather than leaving it to look like a
  backup. Note that ADR-0017
  already gives ifrit's range no backups at all, on the grounds that a
  disposable thing does not need them — the defended estate is on the other
  side of that line, which is the whole reason this is a question.
• Real off-host backup, which needs somewhere to send it. The NAS
  (Plan and build the NAS on VLAN 40 #95) is the obvious candidate and does not exist yet;
  ADR-0016
  and Plan and build the NAS on VLAN 40 #95 have already worked through what may and may not reach it.
• Both, with the datastore local and a sync job somewhere else — which is
  what PBS is actually designed for, and which makes this blocked behind Plan and build the NAS on VLAN 40 #95
  rather than blocked behind nothing.

Also worth deciding

• What it backs up. The Windows domain and the lab observability stack are
  different answers; so is "the lab stack's Loki, because it holds the evidence
  of what the estate saw" versus "not the lab stack, because the evidence is
  reproducible by running the exercise again."
• Whether the estate's existing backup path is a model or a warning.
  make backup quiesces the stack, archives its volumes, encrypts them and
  verifies the result, and homelab-verify-backups.timer re-checks on a
  schedule. A second backup system with none of that verification is one nobody
  will find out has been failing.

Not in scope

Backing up to anything on VLAN 99, which is a path ADR-0007 does not grant.