arbret: our side of running it on vipy

prd-arbret was folded into vipy. arbret itself (app, worker, Postgres, timers,
its backup dump) is deployed by its owner's own repo; this repo owns the
shared host's side of it. arbret_handoff.md documents the split, the Gatus
push API and the backup contract.

- services/arbret: arbret.com -> localhost:3100, www redirects to the apex,
  port 4117 allowed on tailscale0 only, /opt/backups/arbret pre-created to
  the contract so the pull job is green before the first dump.
- headscale ACL: framie may reach prd-vipy:4117.
- vipy: arbret-server, arbret-worker and postgresql in the unit checks.
- 402: DNS and HTTP checks for arbret.com, www, and /api/health with
  [BODY].status == ok. Entries may now name an fqdn outside root_domain and
  add conditions.
- 403: probes arbret-analytics (hourly, 130m window) and arbret-beancount
  (daily, 26h), pushing with the dedicated arbret token.
- backups: pull from backup-pull@prd-vipy:/opt/backups/arbret/, and a
  backup-dump_arbret endpoint.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ansible/playbooks/backups.yml

@@ -12,8 +12,10 @@
         backup_store_check_push_base: "https://{{ subdomains.gatus }}.{{ root_domain }}/api/v1/endpoints"
         backup_store_check_push_token: "{{ gatus_push_tokens[inventory_hostname] }}"
         backup_store_sources:
+          # On vipy since 2026-10-17 (prd-arbret is gone). The arbret repo writes
+          # the dump to the backup_source contract - see arbret_handoff.md.
           - name: arbret
-            source: "arbret@prd-arbret:/opt/arbret/backups/"
+            source: "backup-pull@prd-vipy:/opt/backups/arbret/"
             retention_days: 90
           - name: headscale
             source: "backup-pull@headscale.contrapeso.xyz:/opt/backups/headscale/"
@@ -52,8 +54,8 @@
 # LATENCY and DIAGNOSIS: the store only learns at the next 04:00 pull, and it
 # cannot tell you whether the dump broke or the pull did.
 #
-# arbret has no dump endpoint: prd-arbret lives in [arbret], which `managed`
-# deliberately excludes, so nothing of ours runs there. It is store-checked only.
+# arbret's dump is written by the arbret repo, not by backup_source, and it
+# pushes with its own `arbret` token (the `host` below is the token key).
 # ─────────────────────────────────────────────────────────────────────────────
 - name: Register the backup checks with Gatus
   hosts: observability
@@ -67,6 +69,7 @@
       - {name: lnbits,      host: vipy}
       - {name: forgejo,     host: vipy}
       - {name: jar-lid-archive-staging, host: jar_lid_staging_local}
+      - {name: arbret,      host: arbret}
     store_sources: [arbret, headscale, memos, vaultwarden, lnbits, forgejo, jar-lid-archive-staging]
 
   tasks: