feat(wiki): nightly postgres backup + TOC on the right (#0048/#0050)

Add wikijs-backup, a nightly Borg CronJob (03:30) that dumps the Wiki.js postgres
DB to the Storage Box — the content lives in git-storage, but comments, local
accounts and the search index do not, so the runtime state gets its own backup.
Mirrors authentik-backup (DB-only), reusing synapse-backup-credentials and
-known-hosts with a separate repo path; NetworkPolicy lets the backup pod reach
wikijs-postgres. Also flip tocPosition to right so the page TOC sits beside the
content instead of in the left rail.

apps/production/wikijs-config.py

@@ -205,7 +205,7 @@ def ensure_theming(jwt: str):
     gql('mutation($t:String!,$i:String!,$d:Boolean!,$tp:String,$c:String,$h:String,$b:String){'
         'theming{setConfig(theme:$t,iconset:$i,darkMode:$d,tocPosition:$tp,injectCSS:$c,injectHead:$h,'
         'injectBody:$b){responseResult{succeeded message}}}}',
-        jwt, {"t": tc["theme"], "i": tc["iconset"], "d": True, "tp": tc["tocPosition"],
+        jwt, {"t": tc["theme"], "i": tc["iconset"], "d": True, "tp": "right",
               "c": ACCENT_CSS, "h": tc["injectHead"], "b": tc["injectBody"]})
     # Site-Titel (oben links / Browser-Tab) aus der Deployment-Variable — nicht mehr
     # das hartkodierte "Wiki.js". Reproduzierbar über WIKI_SITE_TITLE.