Back up the age private key off the monitoring host

[Gerrrt]

~/.config/sops/age/keys.txt on the monitoring host is currently the only copy of the private key that can decrypt secrets/observability.sops.yaml.

If that host's disk dies, every encrypted secret in the repo is permanently unrecoverable — the Grafana admin password, the SNMP community and the Alertmanager webhook URL would all have to be rotated from scratch on the devices themselves.

Steps

• Copy ~/.config/sops/age/keys.txt to somewhere durable and offline (password manager entry, or printed and stored physically)
• Verify the backup actually decrypts: SOPS_AGE_KEY_FILE=<backup> sops -d secrets/observability.sops.yaml
• Confirm the backup location is not itself in a git repo or a synced folder that could republish it

Notes

The public half in .sops.yaml is committed and safe — it can only encrypt. It is the private half that has no second copy.

This is a five-minute task with an unbounded downside, which is why it is filed separately rather than as a checkbox in docs/roadmap.md.