rest-server (append-only, tailnet-only on ${hostname}:8008) with a native prune-only job and an offsite restic copy; shared client module backing all hosts into galadriel's repo. Galadriel runs both modules, dataDir on /lorien/backup/restic, service-only paths. Adds sops secrets.
Switch mem_sleep_default from deep (S3) to s2idle - the Phison E21
NVMe hangs on resume from the D3 transition S3 forces. Remove the
no-op d3cold_allowed udev rule (attribute doesn't exist) and the
broken nvme-resume-fix service (ExecStart redirect never ran). Add a
correct runtime-PM-off rule for the NVMe endpoint and its parent root port.