feat(backup): enable the daily backup CronJob on prod (Vault creds wired)

tools#5 granted the erp prod Vault policy read on kvv2/data/longhorn/gcs-backup
(applied + verified: 1 changed, 0 destroyed). So the CronJob's VaultStaticSecret
can now resolve the GCS creds.

- backup.enabled: true (prod), vaultS3Path: longhorn/gcs-backup.
- sandbox overlay keeps backup.enabled: false (reproducible; its env policy wasn't
  granted the read).

ArgoCD will deploy the CronJob + ConfigMap + VaultStaticSecret in the erp namespace.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

chart/values-sandbox.yaml

@@ -38,3 +38,9 @@ ingress:
       paths:
         - path: /
           pathType: Prefix
+
+# The sandbox is reproducible (iso-prod refresh), so it needs no offsite backup —
+# and its env=sandbox Vault policy wasn't granted read on the GCS creds path
+# (only prod was, tools#5). Keep the CronJob off here.
+backup:
+  enabled: false