feat(ops): costs page, 5-minute backups, warm standby, kernel tuning

The costs page states both deductions and, for each game, the maths
return alongside what players actually receive. It is rendered from
/api/fees, which the server generates from the same schedule it charges,
so the published terms cannot drift from the behaviour.

Backups every five minutes with a rolling 24 hours. Each dump is checked
for size and format before replacing the previous one — a backup script
that reports success on a truncated file is worse than none, because it
turns a recoverable outage into silent loss found only when needed. A
nightly job restores the newest snapshot and asserts the ledger balances.

The standby continuously restores into a shadow database and swaps only
after verifying the books, so it is never mid-restore when needed and
never promotes a corrupt copy. Promotion does not contact the dead
machine, and it refuses to start if the ledger does not balance.

Kernel tuning is tied to measured limits, not copied defaults. Alby Hub
is explicitly excluded from snapshot restore: publishing a stale channel
state can lose the channel balance outright.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ops/arcade-verify.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Prove the newest backup can actually be restored
+
+[Service]
+Type=oneshot
+WorkingDirectory=/opt/quantum-arcade
+Environment=ARCADE_BACKUP_DIR=/var/backups/quantum-arcade
+# A backup nobody has restored is a rumour. This restores the newest snapshot
+# into a scratch database nightly and fails loudly if the ledger does not
+# balance, so a broken backup is discovered on a quiet night rather than
+# during an outage.
+ExecStart=/opt/quantum-arcade/ops/backup.sh verify