Add Kopia backup stack with Backblaze B2 offsite target.

Protects /config, selective labdata, and nightly DB dumps; documents homelab improvement plan briefs.

plans/homelab-improvements/tasks/TB-015-vault-secrets-integration.md

@@ -0,0 +1,57 @@
+# TB-015 — Use Vault for real
+
+**Status:** not started  
+**Your call:** _(unset — talk first)_
+
+---
+
+## Talk first
+
+> **Stop.** Don't read Reference until we've talked.
+> In chat, say **"let's do TB-015"** or **"use vault for real"**.
+
+**In one sentence:** Vault runs but secrets live in stack.env — integrate Vault for CI/rotation without changing git-canonical deploy.
+
+**Why it came up:** Optional complexity; only worth it if you want rotation or CI secret centralization.
+
+### Questions
+
+1. What problem would Vault solve that stack.env doesn't?
+2. If 'nothing really' — drop this.
+
+### Your options
+
+| Option | Meaning |
+|--------|---------|
+| **Do it** | We're doing this — I'll implement or walk you through it |
+| **Later** | Keep on the list, not now |
+| **Drop** | Remove from plan — totally fine |
+| **Tweak** | Change scope; tell me how |
+
+### What we decided
+
+| | |
+|---|---|
+| **Decision** | |
+| **Notes** | |
+| **Date** | |
+
+---
+
+<details>
+<summary>Reference (only open if we're doing it)</summary>
+
+### Stack / files
+
+portainer-compose.yml, scripts
+
+### If we do it — rough steps
+
+1. Define Vault vs stack.env boundary
+2. Migrate one token (e.g. github-runner)
+
+### Done when
+
+- [ ] Clear use case — or dropped
+
+</details>