Add documentation for S3 backups with Glacier lifecycle, hourly autodiscovery of new GitHub org repos, daily PAT token refresh, PAT rotation procedure, and Secrets Manager secret inventory.
EC2 (t4g.small, arm64) in private subnet with VPN-only access, DLM nightly snapshots, and Route53 DNS at forgejo.seahaven.com.