Add GCS backup bucket + dual-destination hourly backup (R2 + GCS)

Provision Google Cloud Storage bucket for neuron prod DB backups via Terraform.
Create dedicated backup service account with objectAdmin on the bucket.
Update neuron-prod backup CronJob to run restic against both R2 and GCS hourly —
R2 as primary, GCS as secondary, independent credentials and repositories.

servers/legion/k8s/neuron-technologies/prod/backup-cronjob.yaml

@@ -1,5 +1,5 @@
 ---
-# neuron-backup-credentials — restic + R2 for neuron prod DB backups
+# neuron-backup-credentials — restic + R2 + GCS for neuron prod DB backups
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
@@ -15,10 +15,16 @@ spec:
     creationPolicy: Owner
     template:
       data:
+        # ── R2 (primary) ──
         RESTIC_PASSWORD: "{{ .restic_password }}"
         AWS_ACCESS_KEY_ID: "{{ .r2_access_key_id }}"
         AWS_SECRET_ACCESS_KEY: "{{ .r2_secret_access_key }}"
         RESTIC_REPOSITORY: "s3:https://651161e0a3d321561b4c90b5bcd5f15b.r2.cloudflarestorage.com/legion-neuron-backup"
+        # ── GCS (secondary) ──
+        RESTIC_PASSWORD_GCS: "{{ .restic_password_gcs }}"
+        GCS_SA_KEY_JSON: "{{ .gcs_neuron_backup_sa_key }}"
+        GOOGLE_PROJECT_ID: "neuron-785695"
+        RESTIC_REPOSITORY_GCS: "gs:neuron-backup-neuron-785695:/"
   data:
     - secretKey: restic_password
       remoteRef:
@@ -32,10 +38,17 @@ spec:
       remoteRef:
         key: secret/data/r2
         property: secret_access_key
+    - secretKey: restic_password_gcs
+      remoteRef:
+        key: secret/data/gcs
+        property: neuron_restic_password
+    - secretKey: gcs_neuron_backup_sa_key
+      remoteRef:
+        key: secret/data/gcs
+        property: neuron_backup_sa_key
 ---
-# Hourly neuron prod DB backup to Cloudflare R2 via restic.
-# Retention: 24 hourly, 7 daily, 4 weekly.
-# At current DB size (~10MB) this is <$0.01/month.
+# Hourly neuron prod DB backup to Cloudflare R2 + Google Cloud Storage via restic.
+# Retention: 24 hourly, 7 daily, 4 weekly on both backends.
 # Mounts neuron-prod-data PVC read-only — safe on single-node k3s.
 apiVersion: batch/v1
 kind: CronJob
@@ -46,7 +59,7 @@ spec:
   schedule: "0 * * * *"
   concurrencyPolicy: Forbid
   failedJobsHistoryLimit: 3
-  successfulJobsHistoryLimit: 3
+  successfulJobsHisticsLimit: 3
   jobTemplate:
     spec:
       backoffLimit: 2
@@ -62,11 +75,12 @@ spec:
                 - |
                   set -e
 
-                  # Init repo on first run (no-op if already initialized)
+                  echo "=== Neuron DB backup: $(date -u) ==="
+
+                  # ── R2 backup (primary) ──────────────────────────────────────────
+                  echo "--- R2 backup ---"
                   restic snapshots 2>/dev/null || restic init
 
-                  # Backup the SQLite DB file (WAL mode: exclude -shm/-wal, they're volatile)
-                  echo "Backing up neuron prod DB..."
                   restic backup \
                     /data/neuron-prod.db \
                     --tag neuron-prod \
@@ -74,15 +88,46 @@ spec:
                     --exclude '*.db-shm' \
                     --exclude '*.db-wal'
 
-                  # Prune: 24 hourly, 7 daily, 4 weekly
                   restic forget \
                     --keep-hourly 24 \
                     --keep-daily 7 \
                     --keep-weekly 4 \
                     --prune
 
-                  echo "Backup complete."
-                  restic snapshots --latest 3
+                  echo "R2 backup complete. Latest snapshots:"
+                  restic snapshots --latest 2
+
+                  # ── GCS backup (secondary) ───────────────────────────────────────
+                  echo "--- GCS backup ---"
+                  echo "$GCS_SA_KEY_JSON" > /tmp/gcs-sa.json
+
+                  (
+                    export RESTIC_REPOSITORY="$RESTIC_REPOSITORY_GCS"
+                    export RESTIC_PASSWORD="$RESTIC_PASSWORD_GCS"
+                    export GOOGLE_APPLICATION_CREDENTIALS=/tmp/gcs-sa.json
+                    unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
+
+                    restic snapshots 2>/dev/null || restic init
+
+                    restic backup \
+                      /data/neuron-prod.db \
+                      --tag neuron-prod \
+                      --host legion \
+                      --exclude '*.db-shm' \
+                      --exclude '*.db-wal'
+
+                    restic forget \
+                      --keep-hourly 24 \
+                      --keep-daily 7 \
+                      --keep-weekly 4 \
+                      --prune
+
+                    echo "GCS backup complete. Latest snapshots:"
+                    restic snapshots --latest 2
+                  )
+
+                  rm -f /tmp/gcs-sa.json
+                  echo "=== All backups complete ==="
               envFrom:
                 - secretRef:
                     name: neuron-backup-credentials